E0d/s3 log perms

@jarv @feanil @fredsmith  

related to https://openedx.atlassian.net/browse/DEVOPS-291.  Includes some general re-factoring too.  I'd like to fixate on this service directory creation pattern if you like it.

Still need to test on my sandbox.
why are these directories in the aws role instead of a more generic service role?