You need (I think) to configure your S3 bucket to allow unauthenticated access to your uploaded media. If you enable ‘fine grain access control’ then the S3 upload provider can configure that on an object-by-object basis, so only your uploads have unrestricted access. [It can’t do that retrospectively, so you’d need to adjust permissions on every existing uploaded object.]
If you’re only using the uploads in an app that already requires its own authentication, and you don’t want to allow unrestricted access, you’ll need to use a custom plugin that can fetch the uploads with appropriate S3 authorisation. That plugin can then offer an API route and the controller for that route can check that the user is authenticated [has a current session] within your app. Or, if your app is extending the Strapi UI then you can leave the default auth: true on the API route and rely on Strapi login.