How can the developer provide this authentication functionality?
Use Amazon Cognito with web identity federation.
Use Amazon Cognito with SAML-based identity federation.
Use IAM access keys and secret keys in the application code to allow Get* on the S3 bucket.
Use AWS STS AssumeRole in the application code and assume a role with Get* permissions on the S3 bucket.
Explanations:
Amazon Cognito with web identity federation allows users to authenticate using their Amazon login or social media accounts like Google, Facebook, etc. It integrates easily with S3 for secure access.
SAML-based identity federation is used for integrating with enterprise identity providers (like Active Directory), not for social media or Amazon logins.
Using IAM access keys and secret keys directly in the application code is insecure as it exposes sensitive credentials and is not recommended for user authentication scenarios.
Using AWS STS AssumeRole in the application code assumes a role but does not address social media logins or Amazon login authentication, which is the core requirement.
As I see it, the answer is:
Use Amazon Cognito with web identity federation.