Decide how to handle permissions for retrieving assets from S3 buckets in other accounts

[kenoir]

Sometimes we will want to get assets from S3 outside of the account in which amigo is running, there are various ways to achieve this:

• Allowing access to the amigo account principle for a particular bucket
• Create IAM roles with credentials and pass those as variables
• Do not allow assets to be retrieved from buckets not in the amigo account