You can use presigned urls for that.