Are the SSE-C keys a requirement from your customers or your own architecture? And how many concurrent downloads are you expecting?
A crazy idea, but it’s worth sharing… (only valid depending on your responses above)
You can spin up new S3 buckets on demand, copying files using your full security model and deleting those buckets after the download ends or after a regular interval.
This way, the clients can download files using a much more relaxed security model (but still secure) pre-signed URLs.
