Reply To: URL parameters
Each S3 URL is presigned, which means it’s authorized by Amazon to grant access. However, presigned URLs have an expiration, which is set to 20 minutes by default. Since links in emails can’t be presigned more than once, if you’re getting this error after 20 minutes, it’s because the link has expired.
It also looks like your email service, Sendgrid, is manipulating the URL to add some additional query parameters. These extra parameters could be causing S3 to return the error that the signatures don’t match.