conditional use of local key to fallback to AWS roles