I have some objects that are very large and stored in various duckdb database’s. I would like to pass a presigned URL to authenticated clients to access this data. I’ve built a web app that allows users to query this in R, Python, SQL, takes care of auth, sends requests as range requests… so on.

I want the client to only be able to query these files not download the entire file. What is the path of least resistance to do this?

I was hoping there would be some bucket or individual object policy that I can assign to disallow GET requests for full download but allow for GET HTTP Range requests. I can’t find any documentation about this though, or any docs for types of policies I can attach (like a comprehensive list). Clearly I’m not familiar with this.

Can think of a couple workarounds, but they probably aren’t good

1. Short presigned URL
2. Use Lambda (S3 Object Lambda or some other custom Lambda)
3. Some custom requirements in presigned URL?

I feel like some policy exists for this though.