S3A input stream doesn't handle changing source files any better than the other cloud store connectors. Specifically: it doesn't noticed it has changed, caches the length from startup, and whenever a seek triggers a new GET, you may get one of: old data, new data, and even perhaps go from new data to old data due to eventual consistency.
We can't do anything to stop this, but we could detect changes by
- caching the etag of the first HEAD/GET (we don't get that HEAD on open with S3Guard, BTW)
- on future GET requests, verify the etag of the response
- raise an IOE if the remote file changed during the read.
It's a more dramatic failure, but it stops changes silently corrupting things.