Generate temporary security credentials without Amazon Secure Token Service.

You're looking for ways to generate temporary security credentials without storing permanent credentials locally. Let me clarify your options:

First, your understanding about AWS STS is not entirely accurate. While AWS STS can use credentials from the .aws folder, it doesn't require storing permanent credentials locally. There are several approaches to obtain temporary credentials without storing permanent credentials on your machine:

1. IAM Roles for EC2 Instances: If your application runs on an EC2 instance, you can assign an IAM role to the instance. The instance metadata service automatically provides temporary credentials to applications running on that instance. Your observation about retrieving security credentials from instance metadata is correct for this scenario. Applications can retrieve these credentials without any permanent credentials stored locally.

2. IAM Roles for other AWS compute services: Similar to EC2, if you're using services like Lambda, ECS, or EKS, you can assign IAM roles to these resources, and they'll automatically receive temporary credentials.

3. Identity Federation: You can use identity federation (SAML, OIDC, or custom federation) to authenticate users through an external identity provider and obtain temporary AWS credentials.

Regarding VPC endpoints: VPC endpoints don't provide temporary credentials themselves. They're a networking feature that allows private connectivity between your VPC and supported AWS services without requiring public internet access. While they enhance security by keeping traffic within the AWS network, they don't replace the need for authentication credentials.

For your specific C# use case with AmazonS3Client, if your application runs on an AWS compute service, the AWS SDK for .NET will automatically detect and use the role credentials without any explicit configuration. If running outside AWS, you'll need some form of authentication, but this could be through federation rather than storing permanent credentials.
Sources
Temporary security credentials in IAM - AWS Identity and Access Management
Programmatic access with AWS security credentials - AWS Identity and Access Management
Use temporary credentials with AWS resources - AWS Identity and Access Management