AWS SSM for service credentials.

For users use federated auth/sso with temporary credentials or static user keys that require 2fa with aws-vault.