Private S3 artifact store
Keep S3 objects private and reachable only through regional VPC gateway endpoints, with copy from Sydney to Auckland.
Publish objects in Sydney, replicate them to Auckland, let allowlisted accounts read through VPC endpoints, confirm access from both regions, then remove the stack.