include mention of using IAM instead of ENV for access