title: AWS S3 - credentials exposed in code
body: <p>I'm completely new to AWS and have some security issue.</p>
  
  <p>I want to allow my user to upload a profile picture and I want to save it in S3.
  My code looks like this:</p>
  
  <pre><code>import AWS_S3 from 'aws-sdk/clients/s3';
  import config from '../../config';
  
  const myS3Credentials = {
    accessKeyId: config('AWSS3AccessKeyID'),
    secretAcccessKey: config('AWSS3SecretAccessKey'),
  };
  
  console.log('myS3Credentials:', myS3Credentials);
  
  const S3 = new AWS_S3({
    credentials: myS3Credentials,
    region: config('AWSS3Region'),
  });
  </code></pre>
  
  <p>All of the variables (like <code>AWSS3Region</code>, and my credentials) are set up in the <code>.env</code> file. But here, I'm exposing them in the code. How to avoid that? Or should I set up some bucket permissions?</p>