Can customer programmatic access to S3 objects be direct to S3?

S3 Access Grants can indeed work with customers building their own applications, allowing for direct programmatic access to S3 objects without requiring your application to stand in front of it. However, there are some important considerations to keep in mind.

S3 Access Grants provides a way to grant access to S3 data for both IAM identities and corporate directory identities. This means you can set up access for your customers' backend systems, even if they are not in AWS, by creating appropriate grants.

When using S3 Access Grants, the process typically involves the following steps:

1. Authentication: The user or system authenticates with their identity provider.
2. Token Exchange: The authenticated identity is used to obtain temporary AWS credentials.
3. S3 Access: These credentials are then used to access S3 objects directly.

For customers with their own automated backend systems, you can set up S3 Access Grants to allow their systems to access specific S3 objects or prefixes. This can be done by associating their identity (which could be an IAM user or role, or an identity from a supported corporate directory) with the appropriate grants.

It's important to note that while S3 Access Grants simplifies managing access at scale, you still need to ensure proper authentication and authorization. Your customers' applications would need to implement the necessary steps to authenticate and obtain the required tokens before they can access S3 directly.

To address your concern about trusting customer applications, S3 Access Grants allows you to define fine-grained permissions. You can specify exactly which S3 resources (buckets, prefixes, or objects) each identity can access, and what operations they can perform (read-only, write-only, or read-write).

Additionally, S3 Access Grants integrates with AWS CloudTrail, providing detailed audit logs that include the end-user identity and the application used to access S3 data. This gives you visibility into who is accessing your data and how, even when the access is coming from external applications.

In summary, while the documentation may focus on scenarios involving your own trusted applications, S3 Access Grants can indeed be used to allow direct programmatic access from your customers' backend systems. You maintain control over the access through granular permissions, and you get detailed auditing capabilities. However, you'll need to carefully design your authentication and authorization flow to ensure secure access for these external systems.
Sources
Managing access with S3 Access Grants - Amazon Simple Storage Service
Access control in Amazon S3 - Amazon Simple Storage Service
S3 Access Grants and corporate directory identities - Amazon Simple Storage Service