Your iam token is just a secret by another name. Sure it's more automated but theres no avoiding secret0.