Our concern is that if we return the direct S3 url, people less experienced will assume that the S3 url should work by default, when it will 403. So we return Filepicker.io urls which alias to your S3 bucket

then you should have an example IAM Policy in a very easily accessible location

overall as someone who is currently using filepicker, i would recommend people avoid it if all you want to do is upload to files to your own bucket without any transformations like image resizing

You could leverage zencoder to generate your thumbnails. Send the job as a test so it's free (limited to 5 seconds but that's ok since we only want thumbnails) and specify your thumbnail settings as desired. You could even set the clip length to one frame so the video encoding step is nearly skipped. Since zencoder runs on AWS, you should get near-LAN transfers between S3 and zencoder