Thanks very much for that. In terms of comparing the two approaches, I can see that if you are granting different creds based on a user auth, an STS is useful

Thanks very much for that. In terms of comparing the two approaches, I can see that if you are granting different creds based on a user auth, an STS is useful to grant temporary creds limited to a subset. I'll need to look up the details of how much more fine-grained the STS tokens are than the IAM creds to see how much difference there is in the anonymous case.