Short answer: for authenticated health-report exports, keep each PDF or CSV private, set its content type and content-disposition metadata before signing, and then issue a fresh presigned download link.

Large-file throughput changes the architecture. The application should decide whether a customer may read a report, but object storage should serve the bytes; proxying a 400 MB generated report through the application adds a data path that does nothing for authorization once access has already been approved. A presigned link solves that delivery problem. It does not repair a wrong filename or make an inline object download as an attachment.

The tempting first pass is to sign whatever object the report worker wrote. The better experiment has two constraints: the browser must receive the intended headers, and the file must stay private. The five checks below separate those concerns without turning the application into a large-file relay.

1.…