AWS S3 Private Media Setup

I’m looking for someone who can jump into my AWS account, create or adjust a single S3 bucket so it remains private, and configure it specifically for media storage. Once the bucket is in place, I need direct URLs that already include the necessary security controls—no presigned links that expire, just permanent links that can only be accessed as intended (for example, through a signed CloudFront distribution or an Origin-Access-Control setup).

Here’s what I expect at completion:
• A correctly-configured S3 bucket with private access policies and minimal public exposure
• The IAM roles or policies required for my application to upload and retrieve files programmatically
• At least one working, secure URL that proves the configuration works
• A brief walkthrough (a few lines or quick screen capture) so I can replicate the process if I ever need to

You’re free to use the AWS Console, CLI, or IaC tools like CloudFormation or Terraform if that speeds things up—whatever you’re fastest with is fine by me.