The way to get direct upload to S3 from an IoT device is to leverage AWS IoT. Connecting to AWS IoT uses certificates, which your device has to have anyway, to do the authentication, rather than access key pairs. So you can publish a request for an upload URL, use a rule to pipe it into a Lambda that generates a pre-signed URL specific to that camera, and publishes it to a topic that the camera is listening to.
Then all the camera has to do is the HTTPS PUT to that URL
Sorry, finding a camera that does https put is non trivial. My goal was off the shelf hardware.
I'm using presumed URLs on the REST API side for playback of the videos.
Thanks for the info!
In general, certificates are a good option for long-lived credentials on a device. Unfortunately, you can't yet access them from within an API Gateway custom authorizer, though :-/
Given what I'm doing - at least on the data capture side - I actually like the controller/gateway pattern I've implemented as opposed to having every device connect "up" independently. On the other side - applications talking to the REST API to consume the data captured - I'm using google auth and requests require a token which is validated per request. I'll get I to that part in the next post in the series.
The token validation is done via a customer authenticator.