privatise a function
bucket is read from environment var