Pass S3_REGION and S3_PUBLIC_USE_SSL through compose, treat blank public SSL as unset, and skip CreateBucket when IAM only allows access to an existing bucket.