This happens for all URL signing operations.
No matter it's CLI, SDK or HTTP API.
1 Answers
Note that presigned URLs are a URL format that embeds temporary tokens that is recognized by S3.
However, it is NOT an API call.
So when you call presign operation, you merely construct a URL that is signed with your current credentials. Only when the URL is used, will S3 use the credentials embedded to access an object.
So, check whether your signing party has access to the object before generating presigned URLs. Otherwise you get a URL that is correctly formed, without permissions to access the object and will end up with "Access Denied".
Related