Instead of providing secrets with tokens, the operator could use AWS's v2 SDK (which is already using) for logging in, in case it is running on EKS.
For reference: https://blog.jimmyray.io/kubernetes-workload-identity-with-aws-sdk-for-go-v2-927d2f258057