A research organisation configures a bucket of open datasets as Requester Pays, so anyone downloading the data covers the transfer cost instead of the organisation. An unauthenticated visitor, with no AWS account and no credentials, tries to download an object directly from the bucket's URL. What happens?
- The download succeeds, and AWS bills the visitor's IP address directly for the transfer
- The download succeeds only if the visitor includes the x-amz-request-payer header, even without any credentials
- The request is denied; Requester Pays buckets do not support anonymous, unauthenticated requests at all
- The download succeeds and the organisation is billed, exactly as if Requester Pays were not configured
Why C? And why not the others?
Correct answer: C. The request is denied; Requester Pays buckets do not support anonymous, unauthenticated requests at all
AWS documentation on Requester Pays buckets states directly that if Requester Pays is enabled on a bucket, anonymous access to that bucket is not allowed, and lists anonymous requests explicitly among the request types Requester Pays buckets do not support. Every request against a Requester Pays bucket must be authenticated, specifically so that AWS can identify which requester's account to charge for the request and data transfer; an unauthenticated visitor with no AWS credentials has no account for S3 to bill, so the request is denied outright rather than served. There is no mechanism for AWS to bill an IP address directly for a data transfer; billing is always tied to an authenticated AWS account or the IAM role assumed by the requester, so that option describes a billing model S3 does not have. Including the x-amz-request-payer header is indeed required to accept the transfer charges, but that header alone does nothing without valid AWS credentials backing the request; an anonymous request supplying only that header is still rejected because it remains unauthenticated. The download does not fall back to being billed to the bucket owner as though Requester Pays were absent; enabling Requester Pays specifically closes off the anonymous-access path that would otherwise let the owner absorb the cost, rather than silently preserving the old behaviour for unauthenticated users.
Source: AWS S3 documentation: Using Requester Pays general purpose buckets — anonymous access is not allowed once Requester Pays is enabled