What you're missing is that the secret isn't present. What's there is a policy, which is a way to preauthorize file uploads to S3. The policy is signed with the

What you're missing is that the secret isn't present. What's there is a policy, which is a way to preauthorize file uploads to S3. The policy is signed with the secret key ahead of time. It looks to me like all the fields in that form are safe to be exposed publicly. See http://aws.amazon.com/articles/Java/1434 http://aws.amazon.com/articles/Java/1434. Addendum: The "key" there means key in the S3 sense, as in the name of the object being stored.