Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options:

1. Upload the image to our APIs server, then our APIs server uploads the image to S3  

**Pros:** More secure, as the S3 credentials is only stored at cloud.  

**Cons:** More pressure on APIs server, as thousands of users will be uploading images, with sizes varying from 2 MB to 10 MB
2. Let the mobile app upload the image directly to S3, by getting temp S3 credentials from APIs server for each S3 access.  

**Pros:** Less pressure on API's server, no files will be uploaded to the server.  

**Cons:** Less secure, as S3 credentials will be exposed to the mobile, regardless the fact, that the mobile app will ask for temp credentials each time to access S3, and that it gets the credential through SSL connection with the APIs server.

So, is option two above still better? As we are already granting temp credentials that is valid for only 15 minutes each time to access S3 through SSL connection.

What is the recommended way to do this?