OK, I see:
$ docker run --rm -ti -v $(pwd)/credentials:/root/.aws/credentials:ro -v $(pwd):/data:ro rclone/rclone --s3-endpoint=https://storage.yandexcloud.net --s3-provider=Other ls :s3:mybucket
2022/04/06 23:04:18 NOTICE: Config file "/config/rclone/rclone.conf" not found - using defaults
2022/04/06 23:04:18 Failed to ls: AccessDenied: Access Denied
status code: 403, request id: 38b5dfcca0aa6e31, host id:
The credentials are a static key for the Service Account that has READ and WRITE ACL given on the bucket.