Why Atlassian uses an internal PaaS to regulate AWS access