Hi @jblukach - first, thank you for your support, we really appreciate it!

Do you have an example / more info of what would be needed for this? This would be in place of using the access key env vars for storage?
What is needed to make use of the task policy? We probably also would need to finish #547 since it probably not supported with minio client library. We haven't been using AWS / slightly hesitant to focus on a specific environment, but it is AWS, and maybe there's a way to do it without much impact...

I appreciate all the effort into Webrecorder, which is a big project!

I was wondering if it would be possible to use temporary credentials instead of the static access keys.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html#using-temp-creds-sdk-cli

The container inherits the permissions from the task policy that generates the temporary credentials at runtime that should be accessible from these environment variables.

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN

I saw some past issues for minio around this that are a bit unclear of the outcome, but it does appear support was added, maybe?

https://min.io/docs/minio/linux/developers/python/API.html

It looks like multipart uploads got added, too; just CreateSession is still missing for support.

https://min.io/docs/minio/linux/reference/s3-api-compatibility.html

Is it possible to test for STORE_ACCESS KEY first, as it is nice not to be tied to a specific environment, and if not available, try the AWS temporary credentials?