Handle public/private file distinction on S3 with canned access policies.