I want to mask pre-signed S3 object URL and route it through domain (example.com/S3object). Wondering if this is something can be done through Nginx or some other way.

My concern here is the URL exposes KEY
https://example-images-prod.s3.amazonaws.com/site_1820_plan_1.png?AWSAccessKeyId=#####[…]IYDtY%****%3D&Expires=1721398370

would prefer doing something like example.com/site_1820_plan_1.png so here Nginx access the S3 object through