S3 Bucket Policies Alone Cannot Prevent Cross-Tenant Data Leaks via Presigned URLs

Two HackerOne vulnerability reports — against Shopify and Unikrn — revealed how shared S3 bucket architectures can expose one tenant's data to another, even when bucket policies appear correctly configured. The root cause in both cases was not the bucket policy itself but the application-layer service responsible for generating presigned URLs, which failed to enforce per-tenant prefix restrictions at signing time. When S3 receives a presigned URL request, it validates the cryptographic signature rather than re-evaluating bucket policy against the requester's identity, meaning any prefix the signer encodes is implicitly trusted. Security researchers argue that the signing service must independently verify the requesting tenant's identity, normalise the target key to block path traversal, and confirm the key falls within the correct tenant prefix before minting a URL. Without these three checks in the signer, tenant isolation remains incomplete regardless of how well the bucket policy is written.