diff --git a/.changelog/5280.fixed b/.changelog/5280.fixed
new file mode 100644
index 00000000000..751340f7b06
--- /dev/null
+++ b/.changelog/5280.fixed
@@ -0,0 +1 @@
+`opentelemetry-util-http`: redact `X-Amz-Signature`, `X-Amz-Credential`, and `X-Amz-Security-Token` query parameters
diff --git a/util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py b/util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py
index ac9d97610d3..ef9a16414e7 100644
--- a/util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py
+++ b/util/opentelemetry-util-http/src/opentelemetry/util/http/__init__.py
@@ -56,7 +56,15 @@
     HTTP_SERVER_NAME,
 }
 
-PARAMS_TO_REDACT = ["AWSAccessKeyId", "Signature", "sig", "X-Goog-Signature"]
+PARAMS_TO_REDACT = [
+    "AWSAccessKeyId",
+    "Signature",
+    "sig",
+    "X-Goog-Signature",
+    "X-Amz-Signature",
+    "X-Amz-Credential",
+    "X-Amz-Security-Token",
+]
 
 
 class ExcludeList:
diff --git a/util/opentelemetry-util-http/tests/test_redact_query_parameters.py b/util/opentelemetry-util-http/tests/test_redact_query_parameters.py
index 84e47741890..97a4d435500 100644
--- a/util/opentelemetry-util-http/tests/test_redact_query_parameters.py
+++ b/util/opentelemetry-util-http/tests/test_redact_query_parameters.py
@@ -75,3 +75,40 @@ def test_signature_with_url_encoding(self):
             redact_query_parameters(url),
             "https://service.com?Signature=REDACTED",
         )
+
+    def test_redact_amz_signature(self):
+        url = "https://bucket.s3.amazonaws.com/obj?X-Amz-Signature=abc123"
+        self.assertEqual(
+            redact_query_parameters(url),
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Signature=REDACTED",
+        )
+
+    def test_redact_amz_credential(self):
+        url = (
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Credential="
+            "AKIAEXAMPLE%2F20261101%2Fus-east-1%2Fs3%2Faws4_request"
+        )
+        self.assertEqual(
+            redact_query_parameters(url),
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Credential=REDACTED",
+        )
+
+    def test_redact_amz_security_token(self):
+        url = "https://bucket.s3.amazonaws.com/obj?X-Amz-Security-Token=FwoGZXIvYXdzEXAMPLETOKEN"
+        self.assertEqual(
+            redact_query_parameters(url),
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Security-Token=REDACTED",
+        )
+
+    def test_redact_sigv4_presigned_url(self):
+        url = (
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Algorithm=AWS4-HMAC-SHA256"
+            "&X-Amz-Credential=AKIAEXAMPLE%2F20261101%2Fus-east-1%2Fs3%2Faws4_request"
+            "&X-Amz-Security-Token=FwoGZXIvYXdzEXAMPLETOKEN&X-Amz-Signature=abc123"
+        )
+        self.assertEqual(
+            redact_query_parameters(url),
+            "https://bucket.s3.amazonaws.com/obj?X-Amz-Algorithm=AWS4-HMAC-SHA256"
+            "&X-Amz-Credential=REDACTED"
+            "&X-Amz-Security-Token=REDACTED&X-Amz-Signature=REDACTED",
+        )