Mixing private and public static files in AWS is either fully private or fully public

I am trying to move my static assets to AWS. I am following many blog posts but most of all this one: https://simpleisbetterthancomplex.com/tutorial/2017/08/01/how-to-setup-amazon-s3-in-a-django-project.html

Now I can either make it work so that it all publicly visible or nothing is.

If I add this policy to my bucket everyone can see everything even though I have my config as explained below:

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucket/*"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::accountnbr:user/user"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::mybucket/*"
        }
    ]
}

That should mean everyone can see, only I can edit.

Now I configured my static assets and a private Storage where I want to put my media files. In my static assets I have my css files and so on.

Here is my config:

AWS_ACCESS_KEY_ID = 'mykey'
AWS_SECRET_ACCESS_KEY = 'mysecretkey'
AWS_STORAGE_BUCKET_NAME ='mybucket'
AWS_S3_CUSTOM_DOMAIN = '%s.s3.amazonaws.com' % AWS_STORAGE_BUCKET_NAME
AWS_S3_OBJECT_PARAMETERS = {
    'CacheControl': 'max-age=86400',
}
AWS_LOCATION = 'static'

STATICFILES_DIRS = [
    os.path.join(BASE_DIR, 'mysite/static'),
]
STATIC_URL = 'https://%s/%s/' % (AWS_S3_CUSTOM_DOMAIN, AWS_LOCATION)
STATICFILES_STORAGE = 'config.settings.storage_backends.StaticStorage'
AWS_DEFAULT_ACL = 'public-read'
AWS_PRIVATE_MEDIA_LOCATION = 'media'
PRIVATE_FILE_STORAGE = 'config.settings.storage_backends.PrivateMediaStorage'

then I have this in my storage_backends.py

class StaticStorage(S3Boto3Storage):
    location = 'static'
    default_acl = 'public'

class PrivateMediaStorage(S3Boto3Storage):
    location = settings.AWS_PRIVATE_MEDIA_LOCATION
    default_acl = 'private'
    file_overwrite = False
    custom_domain = False

I didn't configure a public media storage because I only need private media files. And public static files which I think go to my StaticStorage....

Like this unfortunately also my private files can be downloaded via the link.....

I red about pre-signed URLs but shouldn't it work as expected with the config I have? Or am I missing something?

Thanks in advance, very much appreciated!