This backend redirects incoming requests to another s3 service. This will use the incoming credentials to setup the client requests to the external s3 service. So the IAM accounts (or root account) must match what the external s3 service expects.