apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: aws-secrets-manager
spec:
  provider:
    aws:
      service: SecretsManager
      region: {{ .Values.awsRegion }}
      auth:
        # Uses EC2 instance role via IMDS (instance metadata service)
        # No credentials needed - the node role has secretsmanager:GetSecretValue