Our web application features a lot of media upload. We are making use of AWS S3 buckets for media storage. As per the current implementation, whenever a new file upload API is called, we send the AWS credentials to the front end and front end will use these credentials to initiate the file upload.
But a recent security audit reported that it is a bad approach since the AWS credentials can be captured by anyone from the front end and the buckets are readable/writable.
I understand that I can store the AWS credentials at backend only. Then the server can first receive the file when the user uploads and server can then upload it to S3 using these credentails. But as I mentioned earlier, we use a lot of media upload and this process makes it an additional overhead.
What could be other possible ways to resolve the security threat? Can access restricting S3 buckets to only our domain solve the issue?