This is your moment. Let's hear about alternatives.

That’s because the requester is already using AWS and S3 specifically.

One of the most important, yet oft ignored on HN, principles of architecting solutions is having an unbiased view of products and then choosing what will fit within an existing organisation’s architecture.

Given the specifications shared, utilising S3 further is the correct advice.

It gives you at least some basic security. Nothing can get executed on S3, there is no lateral move. If you are using your own servers for user uploads you have to do a damn good job of quarantining them.