I think the approach for S3 is to have the app call a rate limted API to get the download URL, possibly as a pre-signed URL, possibly with an HTTP redirect. Tha

I think the approach for S3 is to have the app call a rate limted API to get the download URL, possibly as a pre-signed URL, possibly with an HTTP redirect. That doesn't help if the client caches that URL and downloads it from S3 directly many times. Alternatively, you could run your own update server, but S3 is so convenient. There's also a concern that the update is designed to check every five minutes. So a rate limit may not actually get exceeded.