Signing URLs for upload to S3 is easy, see [S3 docs](http://docs.aws.amazon.com/AWSJavaScriptSDK/guide/node-examples.html#Amazon_S3__Getting_a_pre-signed_URL_for_a_PUT_operation_with_a_specific_payload). This moves AWS credentials from the worker to the queue. As the worker may executed arbitrary code, we shouldn't give it AWS credentials to an S3 bucket with task definitions...

Signing the S3 put URLs on the queue makes the worker much simpler, and when we implement authentication and authorization this is something that the queue will handle.
I see the queue as the central coordinator that accepts tasks, hence, it should also authenticate the submitter and validate that the submitter have authorization to submit the given task (perhaps based on `provisioner_id` and `worker_type`).