I’m running a production cluster in 0.15.1 for more than a year now and never provided any credentials for Druid to read s3 input.
It is able to use the instance profile attached to your instance to get its permissions (but yeah, I struggled a bit to set it up. I made some improvements to the docs after that).
And it works perfectly for both input bucket and deep storage.
Check the s3 extension parameters
If you want to specifically assume a specific role only during ingestion, it may need specific customizations