Bad idea:
1) Think about how many fun people could empty your bank account when they find your S3 credentials embedded in your Javascript code.
2) javascript will be downloaded from your server and trying to talk to Amazon servers - this is prohibited as cross-domain communication.
You would like to process something like this on the server. You can easily crack the AJAX interface to send data to client browser -> your server -> amazon . Thus, your S3 credentials are stored on your server and are not transmitted by any means to everyone who uses your site.
source share