We're doing the same! The Lambda function also has an authentication layer, so we can protect user-uploaded assets.