Use subdomains for signed S3 URLs