The safest way to give someone access to Amazon S3 is to never give them a key at all. Federation with AWS S3 read‑only roles makes that possible. It grants access without exposing permanent credentials. It keeps your buckets locked tight while still letting the right people read what they need.
To set it up, you create an AWS Identity and Access Management (IAM) role with s3:GetObject permission on the paths you want. Then, you configure a trusted identity provider — AWS supports SAML 2.0, OIDC, and even custom providers. When a user logs in through that provider, AWS Security Token Service issues temporary credentials. Those creds expire fast and require no storage. They can be scoped to a single folder or a single object if you want.
Read‑only access means exactly that: no writes, no deletes, no accidental overrides. S3 read‑only federation is ideal for analytics dashboards, data sharing, and controlled access to logs and reports. Instead of scattering static keys across codebases or configs, every session is authorized in real‑time, and every action is logged in CloudTrail.
To boost security further, use explicit denial statements for actions you don’t allow. Combine them with policies that only match required prefixes. This protects even if a user discovers an unlisted object. Add MFA to the identity provider for critical datasets. Always test policies with iam:SimulatePrincipalPolicy before rollout.