anchor.diff:  export BUILDKITE_S3_DEFAULT_REGION="eu-central-1" # default: us-east-1
   ```
   
  -You will also need to make sure your agent instances have the following IAM policy to read and write objects in the bucket, for example:
  +You will also need to make sure your agent instances have the following IAM
  +policy to read and write objects in the bucket, for example:
   
   ```json
   {
  
positive.code: }
  ```
  
  If you’re running your agents on an AWS EC2 Instance we suggest adding the above policy to [an IAM Role](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html). If you're running outside of AWS, or you’re unable to use an instance role, you can use export `BUILDKITE_S3_ACCESS_KEY_ID` and `BUILDKITE_S3_SECRET_ACCESS_KEY` containing the [Access Key credentials](http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) for an IAM user. See the [Managing Pipeline Secrets](/docs/pipelines/secrets) documentation for how to securely set up these environment variables.
  
  By default the agent will create objects with `public-read` permissions, so that clicking on an artifact link in the Buildkite web interface can go directly to the S3 object to be viewed in the browser. You can set this to private by exporting the following environment variable:
  
  ```bash
  export BUILDKITE_S3_ACL="private"
  ```
  
  If you set your S3 ACL to `private` you won't be able to click through to the artifacts in the Buildkite web interface. You can use an authenticating S3 proxy such as [aws-s3-proxy](https://github.com/pottava/aws-s3-proxy) to provide web access protected by HTTP Basic authentication, which will allow you to view embedded assets such as HTML pages with images. To set the access URL for your proxy, export the following environment variable:
  
  ```bash
  export BUILDKITE_S3_ACCESS_URL="https://buildkite-artifacts.example.com/"
  ```
  
  See the BUILDKITE&#95;S3&#95;ACL variable in the [environment variables list](/docs/pipelines/environment-variables#bk-env-vars) for a full list of access control options.
  
  ## Using your private Google Cloud bucket
  
  
negative.code: 
  ## Using your private AWS S3 bucket
  
  You can use the `buildkite-agent artifact` command to store artifacts in your
  private Amazon S3 bucket. To do so, you’ll need to export some artifact
  environment variables.
  
  You can set these environment variables from a variety of places. Exporting them
  from an [environment hook](/docs/agent/v3/hooks#job-lifecycle-hooks) defined in
  