I personally dont have experience with this but it may be possible using the Amazon API gateway:
Hi Alex -
One solution is to use pre-signed URLs for S3 files:
The CLI makes this pretty easy but it can also be accomplished via program.
The drawback is that these URLs expire - it appears 1 year is the maximum life of the URL.