A partner's integration generates a presigned download link using its own IAM role. The partner downloads over plain HTTP and receives AccessDenied. The link has not expired, and the role holds s3:GetObject permission. What explains the denial?
Show answer and explanation
Answer: B
A presigned request is authorized as the request of the signing principal, and every applicable policy is still evaluated. Here the bucket policy denies requests where aws:SecureTransport is false. An explicit Deny in any applicable policy wins over allows in identity or resource policies, so a valid signature and an unexpired link do not help.
Why the other options are wrong
- A. A valid signature and an unexpired link do not override policy evaluation. The request is still checked against every applicable policy, so this option is incorrect.
- C. IAM does not evaluate policies in creation order. All applicable policies are gathered, and an explicit deny anywhere takes effect, so first-match logic is not how it works.
- D. A resource policy does not get the final word over other policies. An explicit deny in any evaluated policy still blocks the request, regardless of permissive statements elsewhere.