move S3 credentials to environment