Since we do not want to trust agent JVMs with S3 credentials, all BlobCallable implementations should be given a set of presigned URLs for PUT method and not use S3 code at all.