Good question. Authorization is passed along upstream to S3, but we don't re-check authorization when serving a cache hit. In our case, this is a fine tradeoff since our network is private and trusted.

To be more clear, there are other things we could do here if we didn't inherently trust our network and the things running there.

Thanks, I understand.