use acls to limit access to cloud entry point