When a user downloads an S3 artifact, Jenkins generates a signed URL to let them download it directly from S3. This URL lets anybody who knows the URL download the URL until it expires. Short expiry times prevent people from sharing the URL as easily but mean that the server's clock has to be synced to make sure it generates valid URLs.