Set up cloud secrets and short-lived credentials.
Recent revisions are kept. Restoring one creates a new revision.
