By default, AWS does not apply an ACL to keys that are put into a bucket from another account. Having no ACL at all effectively renders the object useless since it cannot be read or anything. The only workaround we found was to explicitly set the ACL policy when putting the object. Additionally boto will list all of the keys in the bucket if it is passed "validate=True" this requires an additional permission.  We want to minimize the set of required permissions so we get a reference to the bucket without validating that it exists.

Change-Id: I0f4d6919c7d2817acb1eb55314191648599c3a0f