I've been working on creating bots for my self-hosted Medplum backned, and I would like to be able to access some of my non-Medplum resources. Is there a programmatic way to add say "s3:GetObject" permissions for my Medplum bots? I can do this manually in the AWS console, but that will become cumbersome to manage.