[lizzas]

I am not an IAM expert but maybe the app should have an admin login that sets the IAM user with full permissions on any s3 bucket(s) needed for the app to work.

There should be instructions on how to set that IAM user up (dont make it the root! It just needs full access to a single bucket ideally).