If you want to try to unravel the STS permissions stuff., https://github.com/osquery/osquery-codesign/pull/52/files is what I was working off. You can trigger the bucket sync job to that branch, and see where it fails