What about you configure your aws cli and tell the agent which command to run for deployment? I found that useful since I don't have to expose any secrets to it, just a static set of commands