apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
name: aws-secrets-manager
spec:
provider:
aws:
service: SecretsManager
region: us-east-1
# No auth block - uses EC2 instance role via AWS SDK default credential chain (IMDS)
