It is actually quite easy. Here is all I did to accomplish that (for customers uploading images). For admin sessions, this is even easier since you can inject your own Javascript in any shop admin... See ShopifyFD from Jason for an example of that.
I placed a file upload field in a Liquid template. Could be page.liquid, product.liquid whatever...
I set the upload to point at my App. I allow CORS from the shop domain. The upload is tied to a cart through the shopify cookies available. Make a cart if the customer has not initiated one.
So the upload hits the App, with the cart ID, and I shuffled that off to S3 for processing.
The App matches the order placed to the image(s) uploaded through the cart token. You can extend this pattern to many use cases easily.