move aws keys to secrets