A browser should upload directly to a private S3 bucket without receiving AWS secret keys. The backend authorizes a particular object upload for a short period. Which mechanism fits?

1. Return only the private bucket name and expect unauthenticated writes to succeed.
2. Embed a permanent IAM secret access key in the browser JavaScript.
3. Make the entire bucket publicly writable for the upload window.
4. Issue a suitably scoped, short-lived presigned upload URL from the authorized backend.