Presigned URL for private S3 bucket displays AWS access key id and bucket name. Is this a security issue?

"Manage your access keys as securely as you do your user name and password."

Your username isn't typically a secret, and the same thing goes for the AWS Access Key ID.

The sensitive value is the access key secret. Both values are useless without the other, but the model is designed to treat the ID (the value starting with AKIA) as the non-sensitive value of the two. Exposing these in signed URLs is acceptable.

The signature also isn't sensitive, since it is not computationally feasible to reconstruct the secret key from the information embedded in a signed URL... but the signature also does not contain enough information for the service to be able to determine who tried to authorize the request... which is why the Access Key ID is included in the signed URL.

In fact, to be precise, the signature doesn't really contain any information at all. The service, internally, looks up your secret key from the provided access key ID and regenerates the same signed URL using your credentials. If it gets the same answer as provided in the URL's signature, the request is valid, otherwise the request is rejected.