add -url to validation key command line option
Add example IAM permissions for S3-based secret files