The 30 second answer
I use IAM roles, never access keys in code or config. On ECS, a task role gives containers temporary credentials. On EKS, Pod Identity or IAM roles for service accounts map a Kubernetes service account to an IAM role. The AWS SDK picks up these credentials automatically. Each service gets its own least-privilege role, so a compromised service can only reach what it really needs.
Use IAM roles, not access keys. On ECS, a task IAM role gives the containers temporary credentials. On EKS, use EKS Pod Identity or IRSA (IAM roles for service accounts), which map a Kubernetes service account to an IAM role. The AWS SDK picks up the credentials on its own. Give each service its own role with least privilege. For calls between services, use OAuth2 client credentials or mTLS. Follow-up: Pod Identity vs IRSA? (Pod Identity is the newer, simpler setup without an OIDC provider per cluster; IRSA still works.)