What AWS permissions should the S3 user for Storage Studio have?
Short answer: Give a dedicated user read, write and delete access to objects in your one bucket — nothing more, and never your main AWS login. Storage Studio doesn't need to create buckets or list every bucket.
Only what it needs: read, write and delete objects in the one bucket you'll use — nothing more. Create a separate user for this in the AWS console rather than using your main AWS login.
Storage Studio doesn't need permission to create buckets or to list every bucket in your account; it works with the bucket you name in the account. When you create the user's access key, Amazon shows the secret only once, so copy both the key and the secret into a password manager straight away.
Keeping access this narrow means that if a key ever leaks, it can only touch that one bucket.