How would you design a secure file upload system?

Secure file upload: 1) S3 pre-signed URLs for direct upload, 2) File type and size validation, 3) Virus scanning with Lambda, 4) S3 bucket policies for access control, 5) CloudFront for secure delivery, 6) Audit logging with CloudTrail, 7) Encryption at rest and in transit, 8) Content moderation if needed.