Lock down security on bot repo to allow write access to contributors

**Is your feature request related to a problem? Please describe.**
Maintainers should have write access to all repos, they currently do not have write access to the bot (due to security concerns).

**Describe the solution you'd like**
Lock down CI to only inject AWS secrets on master pushes.
Lock down AWS credentials to have the minimum credentials required for deployment.

**Additional context**
We don't pass environment variables (Secrets) to forked builds. Which is how we can currently have users fork the repo, put up pull requests and run the test builds.