I think the best solution is to create a Lambda(with pre-signed-url argument), as a proxy, that checks the version of a DynamoDB write. That give the real url only if it is a first time request.