I'm in agreement with both of the proposed changes at the end. Where did you find the API key permissions btw? I looked in the AWS storage account and couldn't find a role that had been used recently.