- do not path authentication header to the final S3 download URL (the auth header is required only to query Acquia API) - do not remove the downloaded file that cannot be opened - leave it for inspection.