URIs that only succeed on a GET cannot currently be used as file sources, as when retrieving file metadata, we use a HEAD request. The most notable of these URI types are Amazon S3 presigned URIs. These URIs contain a signatures with the HTTP method in them, which is usually GET for downloading. This causes them to return a 403 when responding to a HEAD request. If that occurs puppet will fallback to making a partial GET request using the Range header, so that it can retrieve the file checksum and determine if the local file needs to be updated, but do so without retrieving any file content.
Pull request with a fix is here: https://github.com/puppetlabs/puppet/pull/5002