I want to allow users of an iPhone app to upload photos and use Amazon S3. There are 2 ways I see going about this:
they might have provided the sdk for the purpose that maybe the application could permit authentication to individual s3 accounts? e.g an app that lets users store files in their own (user's) bucket instead of provider? i feel a security flaw in merging the keys with application and distributing it. anyone can (mis)use them once the keys are revealed anyhow (its never secure when you're giving it out). on the other hand, keeping the functionality reserved to server will keep your keys transparent to user,isn't it?