No, I did not take a look at the data being sent. I'm sure that in most of the cases I cited, the HTTP payload is encrypted or at least signed. At the very leas

No, I did not take a look at the data being sent. I'm sure that in most of the cases I cited, the HTTP payload is encrypted or at least signed. At the very least, using plain HTTP to communicate with S3 will leak some additional metadata contained in HTTP headers. That may or may not be sensitive or privacy-compromising metadata, but it is metadata that does not need to be leaked.