title: Enforce s3 content type on presigned urls
body: <p>i am using <code>createPresignedPost</code> to let users upload media to my servers, and when it is uploaded s3 dispatches event to my processor lambda, but problem is that i can not validate content-type of the file. if i do not provide</p>
  <pre><code>['starts-with', '$Content-Type', `image/`]
  </code></pre>
  <p>to my <code>createPresignedPost</code> function, system automatically assigns <code>binary/octet-stream</code> content-type to object, which is a problem since i can not match it against my allowed content types (say jpg png and jpeg).</p>
  <p>but if i add the condition user can manually send allowed content-type in headers while submitting file with different content-type, say they wrote <code>Content-Type: image/png</code> but actually sent executable file, which i can not validate even in processor lambda because, when i do <code>getObject</code> or <code>headObject</code> command on s3 for the file, it returns the content-type that was submitted in the form earlier (<code>image/png</code>) even though actual content-type is different.</p>
  <p>I am pretty sure there has to be some kind of solution for this to actually know what the file type is without relying on user to give you valid information.
  Is there something i am not seeing?</p>