Via workload identity (Instance Profiles in this case; IRSA with EKS)