[davidjgraph]

In the flow picture at the bottom, the STS looks like a server to me. What I'm saying is the auth flow still seems to require a server to act as an indirection to the real auth server. But if Amazon provide that part for us, great.

[sha90]

It's not just Amazon providing this-- there is Login With Amazon, but there is also Facebook and Google that act as identity providers. Unless I'm mistaken, this is how Google's storage APIs work too, by using OAuth/OpenID to get an access token that can then be exchanged for keys.

[jeffbarr]

Here's a sample that will let you authenticate using Facebook and then upload content to S3:

http://aws.amazon.com/developers/getting-started/browser/