use iam credentials instead