STS (Security Token Service) can generate credentials with much finer-grained control than just access to a whole bucket. You can require user authentication, do rate limiting, and set expire times. To allow a client to upload an image, for example, you can generate credentials that only grant privileges to a specific file location. It's much better than embedding master IAM credentials in a client.
In terms of comparing the two approaches, I can see that if you are granting different creds based on a user auth, an STS is useful to grant temporary creds limited to a subset.
I'll need to look up the details of how much more fine-grained the STS tokens are than the IAM creds to see how much difference there is in the anonymous case.
They're signed with the same distribution keys and have the same app identifier prefix, so they have access to the same shared keychain storage on the device.
Apple only offers older versions of your app to users that have previously purchased it. New users will still get the traditional "this app requires iOS 7" failure message.
I believe you can purchase apps you haven't purchased before. The writer of the article I read on this tried it. I've downloaded free apps whose latest versions weren't compatible on my device, and got the older version that works for my old (iOS 3.2) device a couple of months ago.
http://www.tested.com/tech/robots/461486-maker-faire-2014-mu...