Triggering a SNS notification when an object is accessed (downloaded) in AWS S3
As you point out, AWS S3 currently does not have an event type for GET calls.

To do something similar to what you are trying to do, I had to do the following:


Create an application/lamdba that's only purpose was to retrieve items from the S3 Bucket.  This application was given exclusive privileges to the S3 bucket.
The application keeps a counter of the number of times that S3 resource has been accessed.
The application returns the 403 or whatever you want if you exceed the download limit.


Basically create a "middleware" that's sole purpose is to go from your website/application to S3 and track the number of requests.

While the above solution meets your requirements, it is vulnerable to common attacks such as DDoS or people spoofing their IP.  If you take this approach consider additional security measures (e.g. only authenticated users can invoke the application's GET call to S3).