tcauth/tcauth.go
func (auth *Auth) AwsS3Credentials(level, bucket, prefix, format string) (*AWSS3CredentialsResponse, error) {
	v := url.Values{}
	if format != "" {
		v.Add("format", format)
	}
	cd := tcclient.Client(*auth)
	responseObject, _, err := (&cd).APICall(nil, "GET", "/aws/s3/"+url.QueryEscape(level)+"/"+url.QueryEscape(bucket)+"/"+url.QueryEscape(prefix), new(AWSS3CredentialsResponse), v)
	return responseObject.(*AWSS3CredentialsResponse), err
}
func (auth *Auth) AwsS3Credentials(level, bucket, prefix, format string) (*AWSS3CredentialsResponse, error) {
	v := url.Values{}
	if format != "" {
		v.Add("format", format)
	}
	cd := tcclient.Client(*auth)
	responseObject, _, err := (&cd).APICall(nil, "GET", "/aws/s3/"+url.QueryEscape(level)+"/"+url.QueryEscape(bucket)+"/"+url.QueryEscape(prefix), new(AWSS3CredentialsResponse), v)
	return responseObject.(*AWSS3CredentialsResponse), err
}
// Get temporary AWS credentials for `read-write` or `read-only` access to
// a given `bucket` and `prefix` within that bucket.
// The `level` parameter can be `read-write` or `read-only` and determines
// which type of credentials are returned. Please note that the `level`
// parameter is required in the scope guarding access.  The bucket name must
// not contain `.`, as recommended by Amazon.
//
// This method can only allow access to a whitelisted set of buckets.  To add
// a bucket to that whitelist, contact the Taskcluster team, who will add it to
// the appropriate IAM policy.  If the bucket is in a different AWS account, you
// will also need to add a bucket policy allowing access from the Taskcluster
// account.  That policy should look like this:
//
// ```js
// {
//   "Version": "2012-10-17",
//   "Statement": [
//     {
//       "Sid": "allow-taskcluster-auth-to-delegate-access",
//       "Effect": "Allow",
//       "Principal": {
//         "AWS": "arn:aws:iam::692406183521:root"
//       },
//       "Action": [
//         "s3:ListBucket",
//         "s3:GetObject",
//         "s3:PutObject",
//         "s3:DeleteObject",
//         "s3:GetBucketLocation"
//       ],
//       "Resource": [
//         "arn:aws:s3:::<bucket>",
//         "arn:aws:s3:::<bucket>/*"
//       ]
//     }
//   ]
// }
// ```
//
// The credentials are set to expire after an hour, but this behavior is
// subject to change. Hence, you should always read the `expires` property
// from the response, if you intend to maintain active credentials in your
// application.
//
// Please note that your `prefix` may not start with slash `/`. Such a prefix
// is allowed on S3, but we forbid it here to discourage bad behavior.
//
// Also note that if your `prefix` doesn't end in a slash `/`, the STS
// credentials may allow access to unexpected keys, as S3 does not treat
// slashes specially.  For example, a prefix of `my-folder` will allow
// access to `my-folder/file.txt` as expected, but also to `my-folder.txt`,
// which may not be intended.
//
// Finally, note that the `PutObjectAcl` call is not allowed.  Passing a canned
// ACL other than `private` to `PutObject` is treated as a `PutObjectAcl` call, and
// will result in an access-denied error from AWS.  This limitation is due to a
// security flaw in Amazon S3 which might otherwise allow indefinite access to
// uploaded objects.
//
// **EC2 metadata compatibility**, if the querystring parameter
// `?format=iam-role-compat` is given, the response will be compatible
// with the JSON exposed by the EC2 metadata service. This aims to ease
// compatibility for libraries and tools built to auto-refresh credentials.
// For details on the format returned by EC2 metadata service see:
// [EC2 User Guide](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials).
//
// Required scopes:
//   If levelIsReadOnly:
//     Any of:
//     - auth:aws-s3:read-only:<bucket>/<prefix>
//     - auth:aws-s3:read-write:<bucket>/<prefix>
//
// See #awsS3Credentials