Use a cloud user with S3/CodeDeploy rights only.