Throwing our S3 service broker out there for others that may find it useful --

https://github.com/epoelke/s3-service-broker

Currently has default plans for most regions as well as location constraint support for buckets created in those regions. IAM users get created for each bucket, as well as a access policy that restricts the user to only the bucket created for the user. API keys and endpoints are returned as VCAP credentials when binding the service to an app.