s3cmd modify s3://myr2/photo.jpg
ERROR: Copy failed for: 's3://myr2/photo.jpg' (403 (SignatureDoesNotMatch): The request signature we calculated does not match the signature you provided. Check your secret access key and signing method. )
It happens because s3cmd is copying cf-ray header and using it for the signature.
A simple fix is to add cf-ray on the _sanitize_headers list.