S3 Credentials

Access keys, secrets, and session tokens authenticate SDKs against S3-compatible endpoints with scoped policies. Rotate leaked pairs immediately and never store them in git. Prefer STS-style temporary credentials for automation when available.