refactor of S3 to make ACL clearer