S3 access private file

A private bucket means that you need to explicitly give access to the bucket and objects for the users or roles. After giving the access, users or roles can use the S3 APIs, like the GetObject to access them, with their own credentials, even cross-account. Note that you can leverage Amazon Cognito to give access to external users as they will have a role attached after login. These accesses can be for the whole bucket or for specific objects. See bucket policies and user policies.

If you end user doesn't have an AWS Credential, you can create a pre-signed url to give temporary access to the object.

Amazon Cognito identity pools provide temporary AWS credentials for users who are guests (unauthenticated) and for users who have been authenticated and received a token. You can implement this for accessing specific objects with in s3 and based on attributes . https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html