Support IAM service accounts for S3 access #1021

Sync-engine should not require AWS secrets to access resources. The code should be able to use the container's underlying service account/role to authenticate. This is often accomplished by simply passing in None for aws_access_key_id and aws_secret_access_key. The codebase might already support this use case but it should be confirmed everything works as expected if these two config variables aren't set.