diff --git a/aws-cli/run.sh b/aws-cli/run.sh
index 5ae9143..68fbcc0 100755
--- a/aws-cli/run.sh
+++ b/aws-cli/run.sh
@@ -69,11 +69,11 @@ cmd() {
 	__warn "Mounting ${localDir} to /mnt/host inside the docker container"
 
 	docker run --rm \
-		-u $(id -u) \
+		-u $(id -u):$(id -g) \
 		--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
 		--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
 		--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
-		-v ${localDir}:/mnt/host \
+		-v "${localDir}":/mnt/host \
 		${CUSTOM_ARGS} \
 		${SERVICE_NAME} \
 		aws "$@"
@@ -95,14 +95,30 @@ upload() {
 
 	__msg "Cache expires on ${EXPIRES}"
 
-	docker run --rm \
-		-u $(id -u) \
-		--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
-		--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
-		--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
-		-v ${source}:/mnt/host \
-		${SERVICE_NAME} \
-		aws s3 cp /mnt/host s3://${target} ${args} --recursive --acl "${ACL}" --expires "${EXPIRES}" --cache-control "max-age=${CACHE_MAX_AGE}" --metadata-directive REPLACE
+
+	if [[ -f ${target} ]]; then
+		# File
+		local dirName=$(dirname ${target})
+		local filename=$(basename ${target})
+		docker run --rm \
+			-u $(id -u):$(id -g) \
+			--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
+			--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
+			--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
+			-v "${dirName}":/mnt/host \
+			${SERVICE_NAME} \
+			aws s3 cp "/mnt/host/${filename}" "s3://${target}" ${args} --acl "${ACL}" --expires "${EXPIRES}" --cache-control "max-age=${CACHE_MAX_AGE}" --metadata-directive REPLACE
+	else
+		# Directory
+		docker run --rm \
+			-u $(id -u):$(id -g) \
+			--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
+			--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
+			--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
+			-v "${source}":/mnt/host \
+			${SERVICE_NAME} \
+			aws s3 cp /mnt/host "s3://${target}" ${args} --recursive --acl "${ACL}" --expires "${EXPIRES}" --cache-control "max-age=${CACHE_MAX_AGE}" --metadata-directive REPLACE
+	fi
 }
 
 download() {
@@ -130,14 +146,30 @@ download() {
 		fi
 	fi
 
-	docker run --rm \
-		-u $(id -u) \
-		--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
-		--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
-		--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
-		-v ${target}:/mnt/host \
-		${SERVICE_NAME} \
-		aws s3 cp s3://${source} /mnt/host ${args} --recursive --acl "${ACL}" --expires "${EXPIRES}" --cache-control "max-age=${CACHE_MAX_AGE}" --metadata-directive REPLACE
+	if [[ -f ${target} ]]; then
+		# File
+		local dirName=$(dirname ${target})
+		local filename=$(basename ${target})
+		docker run --rm \
+			-u $(id -u):$(id -g) \
+			--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
+			--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
+			--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
+			-v "${dirName}":/mnt/host \
+			${SERVICE_NAME} \
+			aws s3 cp "s3://${source}" "/mnt/host/${filename}" ${args}
+	else
+		# Directory
+		docker run --rm \
+			-u $(id -u):$(id -g) \
+			--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
+			--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
+			--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
+			-v "${target}":/mnt/host \
+			${SERVICE_NAME} \
+			aws s3 cp "s3://${source}" /mnt/host ${args} --recursive
+	fi
+
 }
 
 migrate() {
@@ -155,12 +187,12 @@ migrate() {
 	echo "Cache expires on ${EXPIRES}"
 
 	docker run --rm \
-		-u $(id -u) \
+		-u $(id -u):$(id -g) \
 		--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
 		--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
 		--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
 		${SERVICE_NAME} \
-		aws s3 cp s3://${source_dir} s3://${target_dir} ${args} --recursive --acl "${ACL}" --expires "${EXPIRES}" --cache-control "max-age=${CACHE_MAX_AGE}" --metadata-directive REPLACE
+		aws s3 cp "s3://${source_dir}" "s3://${target_dir}" ${args} --recursive --acl "${ACL}" --expires "${EXPIRES}" --cache-control "max-age=${CACHE_MAX_AGE}" --metadata-directive REPLACE
 }
 
 
@@ -173,12 +205,12 @@ setPermissions() {
 	fi
 
 	docker run --rm \
-		-u $(id -u) \
+		-u $(id -u):$(id -g) \
 		--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
 		--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
 		--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
 		${SERVICE_NAME} \
-		aws s3 cp s3://${target_dir} s3://${target_dir} --recursive --acl "${ACL}" --expires "${EXPIRES}" --cache-control "max-age=${CACHE_MAX_AGE}" --metadata-directive REPLACE
+		aws s3 cp "s3://${target_dir}" "s3://${target_dir}" --recursive --acl "${ACL}" --expires "${EXPIRES}" --cache-control "max-age=${CACHE_MAX_AGE}" --metadata-directive REPLACE
 }
 
 
@@ -196,11 +228,11 @@ exec() {
 	fi
 
 	docker run --rm -it \
-		-u $(id -u) \
+		-u $(id -u):$(id -g) \
 		--env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
 		--env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
 		--env AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION} \
-		-v ${source_dir}:/mnt/host \
+		-v "${source_dir}":/mnt/host \
 		${SERVICE_NAME} \
 		sh
 }