docs: def awsS3Credentials(self, *args, **kwargs):
          """
          Get Temporary Read/Write Credentials S3
  
          Get temporary AWS credentials for `read-write` or `read-only` access to
          a given `bucket` and `prefix` within that bucket.
          The `level` parameter can be `read-write` or `read-only` and determines
          which type of credentials are returned. Please note that the `level`
          parameter is required in the scope guarding access.  The bucket name must
          not contain `.`, as recommended by Amazon.
  
          This method can only allow access to a whitelisted set of buckets.  To add
          a bucket to that whitelist, contact the Taskcluster team, who will add it to
          the appropriate IAM policy.  If the bucket is in a different AWS account, you
          will also need to add a bucket policy allowing access from the Taskcluster
          account.  That policy should look like this:
  
          ```
          {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Sid": "allow-taskcluster-auth-to-delegate-access",
                "Effect": "Allow",
                "Principal": {
                  "AWS": "arn:aws:iam::692406183521:root"
                },
                "Action": [
                  "s3:ListBucket",
                  "s3:GetObject",
                  "s3:PutObject",
                  "s3:DeleteObject",
                  "s3:GetBucketLocation"
                ],
                "Resource": [
                  "arn:aws:s3:::<bucket>",
                  "arn:aws:s3:::<bucket>/*"
                ]
              }
            ]
          }
          ```
  
          The credentials are set to expire after an hour, but this behavior is
          subject to change. Hence, you should always read the `expires` property
          from the response, if you intend to maintain active credentials in your
          application.
  
          Please note that your `prefix` may not start with slash `/`. Such a prefix
          is allowed on S3, but we forbid it here to discourage bad behavior.
  
          Also note that if your `prefix` doesn't end in a slash `/`, the STS
          credentials may allow access to unexpected keys, as S3 does not treat
          slashes specially.  For example, a prefix of `my-folder` will allow
          access to `my-folder/file.txt` as expected, but also to `my-folder.txt`,
          which may not be intended.
  
          Finally, note that the `PutObjectAcl` call is not allowed.  Passing a canned
          ACL other than `private` to `PutObject` is treated as a `PutObjectAcl` call, and
          will result in an access-denied error from AWS.  This limitation is due to a
          security flaw in Amazon S3 which might otherwise allow indefinite access to
          uploaded objects.
  
          **EC2 metadata compatibility**, if the querystring parameter
          `?format=iam-role-compat` is given, the response will be compatible
          with the JSON exposed by the EC2 metadata service. This aims to ease
          compatibility for libraries and tools built to auto-refresh credentials.
          For details on the format returned by EC2 metadata service see:
          [EC2 User Guide](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials).
  
          This method gives output: ``v1/aws-s3-credentials-response.json#``
  
          This method is ``stable``
          """
  
          return self._makeApiCall(self.funcinfo["awsS3Credentials"], *args, **kwargs)