Grant IAM permissions to S3 bucket as well as the buckets therein (thanks @ktheory)
Default to a specific version of official registry image