Function put_only_policy 

pub fn put_only_policy(bucket: &str, prefix: &str) -> String

The IAM inline policy: s3:PutObject and nothing else, scoped to the vault prefix. No Get/List/Delete — a compromised host can only add objects.