You still can use POST policies, they don't need to be defined on the bucket but only signed. But you are limited on what you can check. Other than that, yeah,

You still can use POST policies, they don't need to be defined on the bucket but only signed. But you are limited on what you can check. Other than that, yeah, the approach might not have been adequate.