@tedivm I'm always baffled when people use random filenames when they make file accessible to trusted users.
S3 already has an API to support signed downloads, and all the application needs to do is to sign a URL which the client can use to access the resource.
I've implemented it from scratch (there was no client library for Common Lisp at the time) and it was trivial. If you have a library, it's literally one function call. There is no excuse for this.