At least 8 characters. Written to config/credentials.php.
Username and S3 settings are edited directly in the files under config/.
config/