It only means No. 2. The bucket name will be configured in both places. For example, we might call the bucket "apk-staging" and all S3 paths would be assumed to be in that bucket. The S3 paths would not be publicly accessible for unsigned APKs. So, yes, both the factory and the signer would need to be configured with the same AWS credentials and the same master bucket.