You can actually kind of do that. There's a system intended to allow random users credential-free upload access to your buckets via POST, but you can enforce policy control like "the target has to have xyz/ as a prefix" and "the size must be fewer than 100000 bytes". Here are the S3 docs for it: http://docs.amazonwebservices.com/AmazonS3/2006-03-01/index....