It was an issue we discussed quite a bit when working on Bucketio. If you're S3 savvy, we recommend that you create a limited user and give it access to JUST the bucket you want us using. If you're not, then you can provide your Master keys and the system does the setup for you. We create a limited user with access to a single bucket we create, set the CORS needed for uploading, then we forget your master keys and connect using the new user ONLY.
Do you have any interest in providing a guide for your users to do that themselves? Obviously they'd have to trust you to some degree to follow your guide and assume you're not tricking them. I'm generally not a very paranoid person, but in this case I have a couple EC2 servers running for clients that would be a bitch to fix if someone messed with them.
That would be awesome. I fooled around with it and failed. I created a user with S3 full access (I have nothing else using S3) and it complains that access is denied.
