Can Amazon S3 object url be protected from being accessed by anyone?

This answer assumes you want to allow access to the resources only for the application users. If that’s not the case, you may need to ask more specific question.

This link can be opened by anyone whether or not the user is a member of my website

If you make the resource public, you basically allowed any unauthenticated access. Regardless from your application or not.

The default (adviced) way to protect the resources is making the object private and make the application creating a signed (temporary) url.

https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/examples-s3-presign.html

               GetObjectRequest getObjectRequest = GetObjectRequest.builder()
                   .bucket(bucketName)
                   .key(keyName)
                   .build();

               GetObjectPresignRequest getObjectPresignRequest = GetObjectPresignRequest.builder()
                   .signatureDuration(Duration.ofMinutes(60))
                   .getObjectRequest(getObjectRequest)
                   .build();

               PresignedGetObjectRequest presignedGetObjectRequest = presigner.presignGetObject(getObjectPresignRequest);
               String theUrl = presignedGetObjectRequest.url().toString();