Better way to isolate s3 credentials