S3 Presigned URL Signature Auditor

The Incident (What Does the Error Mean?)

You hit this raw error from AWS S3:

<Error>
  <Code>SignatureDoesNotMatch</Code>
  <Message>The request signature we calculated does not match the signature you provided.
  Check your key and signing method.</Message>
  <AWSAccessKeyId>AKIAIOSFODNN7EXAMPLE</AWSAccessKeyId>
  <StringToSign>AWS4-HMAC-SHA256
20240115T142300Z
20240115/us-east-1/s3/aws4_request
abc123...</StringToSign>
  <SignatureProvided>abcdef1234567890...</SignatureProvided>
  <StringToSignBytes>41 57 53 34...</StringToSignBytes>
  <RequestId>EXAMPLE123456789</RequestId>
  <HostId>EXAMPLE+HOST+ID==</HostId>
</Error>

Immediate consequence: Every consumer of that presigned URL — your frontend upload widget, your CDN origin fetch, your partner API callback — gets an HTTP 403. The URL is cryptographically dead. It cannot be retried. It must be regenerated.

A presigned URL is a snapshot of credentials at generation time. It encodes X-Amz-Credential, X-Amz-Signature, and X-Amz-Security-Token (if STS-based) directly into the query string. The moment the IAM policy governing those credentials changes in a way that affects the signing context — or the credentials themselves are rotated/invalidated — AWS's signature verification fails at the SigV4 HMAC comparison step.

The Attack Vector / Blast Radius

This is not just a broken URL. Here is the full blast radius:

1. Silent production breakage at scale. If your application pre-generates presigned URLs and caches them (Redis, DynamoDB TTL, CDN edge cache), every cached URL is now a 403. Users see broken downloads, failed uploads, and cryptic permission errors with no actionable message.

2. The dangerous misdiagnosis trap. Engineers under pressure misread SignatureDoesNotMatch as a key rotation issue and immediately rotate the IAM access key — which generates new credentials but doesn't fix the root cause (the policy condition or STS token invalidation). Now you have rotated keys AND broken URLs.

3. STS session token invalidation cascade. If the presigned URL was generated using AssumeRole temporary credentials (STS), and the role's trust policy or permission boundary was updated, the session token embedded in X-Amz-Security-Token is invalidated server-side. No amount of URL regeneration with the old STS token fixes this. You must re-assume the role.

4. MFA condition injection. If an admin added aws:MultiFactorAuthPresent: true as a condition to the S3 bucket policy or IAM policy after URLs were generated, those pre-generated URLs — signed without an MFA session — will permanently fail, even if the signing key is valid.

5. Cross-region endpoint mismatch. A policy update that moves bucket access to a specific VPC endpoint or enforces aws:SourceVpc conditions will cause SigV4 region/endpoint mismatches if your URL was generated against s3.amazonaws.com instead of the regional endpoint s3.us-east-1.amazonaws.com.

Prevention in CI/CD

1. Checkov — Catch Overpermissive Presign Policies Pre-Merge

# .checkov.yml
checks:
  - CKV_AWS_53   # Ensure S3 bucket has block public ACLs
  - CKV_AWS_54   # Ensure S3 bucket has block public policy
  - CKV_AWS_19   # Ensure S3 bucket has server-side encryption

Run in CI:

checkov -d ./terraform --framework terraform \
  --check CKV_AWS_53,CKV_AWS_54 \
  --soft-fail-on MEDIUM

2. OPA Policy — Enforce SigV4 and Regional Endpoints

# policy/s3_presign.rego
package aws.s3.presign

deny[msg] {
  input.signature_version != "s3v4"
  msg := "Presigned URLs must use SigV4. SigV2 is deprecated and insecure."
}

deny[msg] {
  not contains(input.endpoint_url, input.region)
  msg := sprintf("Endpoint '%v' does not match region '%v'. Use regional S3 endpoints.",
    [input.endpoint_url, input.region])
}

deny[msg] {
  input.expires_in > 3600
  msg := "Presigned URL expiry must not exceed 3600 seconds for STS-backed credentials."
}

3. AWS CloudTrail Alert — Detect Policy Changes That Break Presigned URLs

Deploy this EventBridge rule to alert when IAM policy mutations occur against roles/users that generate presigned URLs:

{
  "source": ["aws.iam"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["iam.amazonaws.com"],
    "eventName": [
      "PutUserPolicy",
      "AttachUserPolicy",
      "DetachUserPolicy",
      "PutRolePolicy",
      "AttachRolePolicy",
      "DetachRolePolicy",
      "PutRolePermissionsBoundary"
    ],
    "requestParameters": {
      "userName": ["s3-presign-service-user"]
    }
  }
}

Route this to an SNS topic that triggers a Lambda to invalidate your presigned URL cache (Redis DEL, DynamoDB TTL reset) immediately on policy change.

4. Terraform — Lock Presign IAM User to Least-Privilege Inline Policy

- # BAD: Managed policy allows broad S3 access — any policy update breaks presigned URLs unpredictably
- resource "aws_iam_user_policy_attachment" "presign_user" {
-   user       = aws_iam_user.presign.name
-   policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
- }

+ # GOOD: Inline policy scoped to exact bucket and operation
+ resource "aws_iam_user_policy" "presign_user_inline" {
+   name = "s3-presign-least-privilege"
+   user = aws_iam_user.presign.name
+
+   policy = jsonencode({
+     Version = "2012-10-17"
+     Statement = [{
+       Sid      = "PresignGetOnly"
+       Effect   = "Allow"
+       Action   = ["s3:GetObject"]
+       Resource = "arn:aws:s3:::${var.bucket_name}/${var.allowed_prefix}/*"
+       Condition = {
+         StringEquals = {
+           "aws:RequestedRegion" = var.aws_region
+         }
+       }
+     }]
+   })
+ }

Narrow scope = fewer policy changes that can break signature context.