User level permissions on Amazon s3 on Public read URL -

i have uploaded few files on amazon s3 cannedchannellist publicread. remember file has public read permissions, not whole bucket or folder. , user able access file using given url. here 1 security concern user can manipulate given url access other files in same or different folder. there way user need send authentication key while hitting url, while reading file , how can let users know authentication key have use? i've read iam users uploading file , that. want authentication while reading data using url.

data uploaded single admin user, however, users sent data server , using single admin user uploading of on s3.

this policy using admin user.

if(isbucketexist(bucketname)){                 statement allowpublicreadstatement = new     statement(statement.effect.allow)                          .withprincipals(principal.allusers)                          .withactions(s3actions.getobject)                         .withresources(new s3objectresource(bucketname, "*")); policy policy = new policy()                         .withstatements(allowpublicreadstatement                                                         ); amazons3.setbucketpolicy(bucketname, policy.tojson());             } 

and cannedchannellist while uploading data

initiatemultipartuploadrequest(bucketname, foldername).withcannedacl(cannedaccesscontrollist.publicread); 

have tried using "s3:getobject" action on iam policy , can specify resource arn "arn:aws:s3:::examplebucket/*" or specific prefix want users have read access to.

an example of iam policy like:

{ "version": "2012-10-17", "statement": [     {         "sid": "allowlistingofs3",         "action": [             "s3:listbucket"         ],         "effect": "allow",         "resource": [             "arn:aws:s3:::bucket-name"         ],         "condition": {             "stringlike": {                 "s3:prefix": [                     "folder/sub-folder/*"                 ]             }         }     },     {         "sid": "allowalls3actionsinfolder",         "effect": "allow",         "action": [             "s3:getobject"         ],         "resource": [             "arn:aws:s3:::bucket-name/folder/sub-folder/*"         ]     } ] }