S3 does handle authentication by giving you a temporary upload URL so your bucket isn't wide open. But I agree it isn't the simplest solution.