Looks like I have to create a bucket per service if I want fine-grained access control. Wondered if anyone had any insight to usage patterns.