I'm trying to hide the credentials to my boto3 client situated in a kivy app (python3). The boto3 is being used for SecretsManager to hold other credentials for RDS db access.

```
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name,
        aws_access_key_id='AK########.....'

```

I don't want to hard code my access key, secret etc

I've thought about assigning a specific `IAM` role to this client which would in theory give me the role/access required to boto3 but don't know exactly how to go about this. 

I also use cognito for login (auth); I could possibly set up a group which is attached to these users and then get the creds/access to the boto3 client via this (which I think would work).

Is there a better solution to this or is my workflow all wrong?!

Many thanks!