First, Cognito Identity Pool is used to create an STS token based on an unauthenticated identity and a restricted IAM Role. An S3 object is already present. Using the STS token, a (pre)signed URL is generated that allows 'public' access for a specific period only.