diff --git a/awscli/customizations/s3/subcommands.py b/awscli/customizations/s3/subcommands.py
index bd3f60f16479..f5c1abcb7515 100644
--- a/awscli/customizations/s3/subcommands.py
+++ b/awscli/customizations/s3/subcommands.py
@@ -767,6 +767,22 @@ class PresignCommand(S3Command):
         "anyone who receives the pre-signed URL to retrieve the S3 object "
         "with an HTTP GET request. For sigv4 requests the region needs to be "
         "configured explicitly."
+        "\n\n"
+        ".. warning::\n"
+        "\n"
+        "    For backwards compatibility, S3 pre-signed URLs use Signature\n"
+        "    Version 2 by default in regions where S3 supports it. As a\n"
+        "    result, query parameters appended to the URL after it is\n"
+        "    generated are not covered by the signature, and can be added,\n"
+        "    changed, or removed by anyone holding the URL without\n"
+        "    invalidating it.\n"
+        "\n"
+        "    To use Signature Version 4 instead, add an ``s3`` section to\n"
+        "    your profile in the AWS CLI configuration file::\n"
+        "\n"
+        "        [profile my-profile]\n"
+        "        s3 =\n"
+        "            signature_version = s3v4\n"
     )
     USAGE = "<S3Uri>"
     ARG_TABLE = [{'name': 'path',