If you want to apply S3 bucket policy to protect the GET access originating from a URL , check this example out :
Restricting Access to a Specific HTTP Referrer
Check out reference diagram to design a zero trust pipeline https://blogs.oracle.com/cloud-infrastructure/designing-zero-trust-and-resilie...