How do you design file storage for uploads (S3-style) with secure access?

A robust design uses object storage + secure URLs. **Approach:** - Upload directly to object storage using pre-signed URLs - Store metadata in DB (owner, path, mime, size) - Serve via CDN - Enforce authorization (private buckets, signed URLs) - Validate file type/size and scan if needed This avoids overloading app servers and scales well.