feature: metadata-credentials

try to load credentials from IAM if they haven't been otherwise provided