You do need a server to create a token from your access key and secret. However, this doesn't really go very far in protecting your bucket, as somebody could ju

You do need a server to create a token from your access key and secret. However, this doesn't really go very far in protecting your bucket, as somebody could just grab that token and upload whatever they want. So an additional layer of security is creating an upload bucket with a policy where all objects over 24h old are deleted. When somebody finishes uploading a file, you ping your server and move the file from the upload bucket to the real bucket. Another trick is putting Cloudfront in front of that bucket. You can then upload to any Cloudfront server, which will then put the file in your bucket -- the reduced latency to a Cloudfront (vs S3) will increase the speed at which you upload by quite a bit.