handle s3 credentials locally always, but pass buckets around as strings since they are invariant wherever the cluster is running.