Moving S3 credentials out to a seperate secret allows more flexibility (especially when switching out JWT for oAuth2 implementations)