Yes I ended up doing the exact same thing–switching to pre-signing URLs externally in Lambda and receiving them back to the Atlas function. There was no other solution I could find to do it all within Atlas.
But now that they’re deprecating almost all of Atlas App Services, this issue doesn’t even matter for us anymore since we had to switch almost our entire app to Lambda anyway haha.