A Node.js image pipeline that uses Sharp to resize each thumbnail before upload still begins with a storage constraint: a signed document and every derivative must have an explicit, observable, and enforceable deletion deadline. Storage cost matters, but an inexpensive object that survives its retention decision is a correctness failure.

Short answer: keep originals and resized thumbnails under distinct, predictable keys in a private object bucket, record their deletion deadline and current key set in a database, and issue short-lived presigned GET URLs for downloads. Generate derivatives in application code or a worker. Never treat object metadata as the index or overwrite a live key in place.

This choice makes the effective bill a workload question rather than a price-list question. Model original bytes, derivative bytes, write and read operations, signed-download traffic, worker compute, database indexing, reconciliation, and deletion work.…