document shared secret in aws vpc manifest better
add initial ci config for resource blobs