S3 will not check if the requesting people are logged into their AWS accounts. Instead, the request must use one of the authentication methods.

If you want to share links that can be opened in a browser, pre-signed URLs are usually a good way to go. However, they expire after a maximum expiration time of 7 days. If you want longer expiration times, Cloudfront has more options to share content from S3 buckets securely.