Comment 1 for bug 1172973

Chasing through the code a little (and I'm not a go programmer at all, but this seems fairly clear):

cmd/juju/synctools.go:officialBucketAttrs does not have an access-key or secret-key set
cmd/juju/synctools.go:Run calls environs.NewFromAttrs(officialBucketAttrs)
environs/open.go:NewFromAttrs: calls cNew
environs/config.go:New calls Open on an ec2.environProvider
environs/ec2/ec2.go:Open calls SetConfig on an environ
SetConfig calls newConfig
newConfig calls Validate
Validate complains if the passed in config _and_ the environment do not have an access key and a secret key -- and as the passed in config does not (it is made from officialBucketAttrs), the only way this can pass is if the environment has the keys.

I'd guess there needs to be some way to tell Validate that not having the keys is ok, but I'll leave that sort of thing to someone who understands the architecture :)