I already had a resume download gate — email required, signed link, 15-minute expiry, presigned S3 URL good for two minutes. What it didn't have was a way for me to know it happened. Someone could download my resume and I'd never find out unless I went digging through ResumeDownloadRequest rows...
Source: [Dev.to](https://dev.to/highcenburg/closing-the-loop-emailing-myself-when-my-resume-gets-downloaded-h8j)