update to make aws key and secret optional, if using IAM roles