Q:

Is it okay to publish credentials for an IAM user with NO permissions?

I want to create an IAM user that can activate the JS SDK on the clientside that allows anyone (intentionally) to upload files to a specific s3 Bucket.  
In order to use the SDK, I need to give it credentials.
Is it okay to to publish keys for an IAM user with ZERO permissions to simply activate the SDK?  
Security will be handled on the bucket policy.

A:

why not use an anonymous cognito-identity pool and the cognito-identity credentials provider? it was designed largely for this purpose.
http://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/loading-browser-credentials-cognito.html
Notice there is an unauthenticated or "anonymous" mode

