title: How to programmatically control cogonito user access S3 object
body: <p><strong>Background</strong></p>
  
  <p>I use S3 to store paid content. My app also uses Cognito to authenticate users and also tracks who purchased what content. But how can I make an S3 object only accessible to the paid users?</p>
  
  <p>For example: the object at "mybucket/private-content/obj1.pdf" needs to be accessible to user A but not to user B depending on the purchase record.</p>
  
  <p>I can think of two solutions for now but none of them are ideal.</p>
  
  <p><strong>Solution 1</strong></p>
  
  <p>Make the bucket private. Then generate a signed URL for an object after the user purchased the content.
  <strong>Problem</strong>: User A can purchase the content and share the signed URL to user B. User B can access the object without paying.</p>
  
  <p><strong>Solution 2</strong>
  Every time when a user purchased some content, copy the object to a user folder in S3. And use a bucket policy to limit the user only accessing his own folder.
  <strong>Problem</strong>: Need to duplicate content over and over. This increases my storage cost.</p>