Tech Challenge

2026-07-30

🔐

Daily Tech Challenge

Cybersecurity

medium

Question 1 of 5

A backend generates the link below so a customer can download an invoice. The bucket has S3 Block Public Access enabled and every object ACL is private. The developer pastes the resulting link into a shared support-ticket thread, arguing that "the bucket is private, so only the customer's browser can use it". What does that URL actually grant?

Example

url = s3.generate_presigned_url(
    'get_object',
    Params={'Bucket': 'acme-invoices', 'Key': f'{customer_id}/invoice-8841.pdf'},
    ExpiresIn=604800,          # 7 days
)
# https://acme-invoices.s3.amazonaws.com/c-4417/invoice-8841.pdf
#   ?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=...
#   &X-Amz-Date=20260730T210000Z&X-Amz-Expires=604800&X-Amz-Signature=9f2c...

Thursday, July 30, 2026 · A new challenge drops every day