Create reference architecture for on-premises systems accessing S3 via IoT as a Credentials Provider

[timmattison]

Authorizing Direct Calls to AWS Services is a great way for on-premises devices to access AWS without having to have long lived IAM credentials stored locally or having to build a second authentication mechanism that vends temporary credentials. It also offers two migration paths for improved operations. First, customers can use certificates with secure hardware (TPMs, HSMs, secure elements). Second, customers can access AWS IoT Core easily for messaging and telemetry.

This pattern is particularly relevant for storage partners but other types of partners can make use of as well for IoT and non-IoT applications.