In the docs, `s3` is mentioned as a permitted source. However, unless I've missed it somewhere, the docs are silent on how to deal with `s3` credentials ?