Leave EVERYTHING up to the browser and S3.
Fine Uploader can handle the S3 request signing for you. Just provide temporary credentials for your locked-down IAM user and pass them off to Fine Uploader S3. You can do this all client-side, easily and securely, using Google, Facebook, or Amazon as an identity provider, and the AWS JavaScript SDK. Need more details? Read the blog post that covers step-by-step setup for this workflow.
This demo uses only client-side code to authenticate and upload files to S3. We have not written any server-side code at all. In fact, the entire example is hosted in an S3 bucket. Try it out by choosing one of the identity providers to the right.
Note: If you simply want to avoid the signature HTTP requests for each file/chunk, and need to support legacy browsers, you can do that too, but some server-side code will be required to utilize the AWS temporary credentials calls. See the client-side signing feature page in the documentation for more details.