Aren’t you able to upload directly from the browser maybe?
Have a look here:
you can do step 2 from the browser and step 1 and 3 from your lambda so that you don’t have to share the write token to the browser, what do you think?
Inspect what the browser is doing in our media area, it’s the exact same idea 