Add ability to override S3 access policy ke prefix

[bacek]

Isn't it actually a suffix? :)

It is key prefix. But one can argue that this is resource suffix :)