Anyone entering their S3 credentials should only enable the s3:GetObject scope, which we mention on the dashboard. They can also pass presigned URLs instead.
As far as rolling it yourself, it's certainly doable. This project started as an internal feature for our other business. Like most things, it ended up being more complicated + took longer than we thought and we were surprised there was no easy-to-use, plug-and-play solution to this problem.
We generally believe in operating at the highest level of abstraction to focus on the product, and felt that this was a hole in dev tooling!
>That's pretty nifty.
Thank you! The sms href is pretty underutilized. We’re thinking about using it in a CRM tool as well with the auto-filled fields.