The AWS SDK for Java 2 with the secret access key off the heap: a SigV4 signer whose key is read into native memory and used there, for S3, SQS, DynamoDB and every other client - and for S3-compatible stores such as MinIO or Ceph.