Question

During a cloud application assessment, you notice the web app generates AWS S3 presigned URLs to let users download their own invoice PDFs. A sample URL is: https://invoices.s3.amazonaws.com/user/1042/invoice-2024.pdf?X-Amz-Signature=abc123&X-Amz-Expires=3600&X-Amz-Credential=AKIA...%2Fs3%2Faws4_request. You change the path from user/1042 to user/1001 while keeping the same signature and query parameters. Which outcome should you expect, and what does it reveal?

Accepted Answer

The request returns HTTP 403 SignatureDoesNotMatch, because the signature is bound to the exact object key and cannot be reused for a different path

Answer

The request succeeds and returns user 1001's invoice, proving the presigned URL grants access to the entire bucket

Answer

The request returns HTTP 200 for any path, because presigned URLs authenticate the IAM user rather than the specific resource

Answer

The request triggers an automatic AWS CloudTrail block that rotates the access key and invalidates all presigned URLs