awscli: better sandboxing
awscli: add functional test