The many ways to obtain credentials in AWS

A deep dive into how AWS applications obtain IAM credentials—SDK provider chain, environment variables, credentials files, IMDS/IMDSv2, and container endpoints—plus what defenders should watch for.