What I have done is to create an application which gets signed url's from AWS and delivers them back to the end user while at the same time keeps record of how many times a signed url was generated for any given file. Works perfectly.

Correct, my mistake. AWS indeed stores them in plain text after all.

So, it they cannot be read after initial setup, that is the way AWS works?