A claims portal lets policyholders upload a supporting document straight from their browser to an S3 bucket. The bucket must stay private, the policyholders have no AWS accounts and must never receive AWS credentials, and each upload authorisation should be usable only for that one object key and only for the next 15 minutes.