Not an iOS developer, but curious what’s the current state of the art for distributing and storing your credentials if the app needs to make AWS service calls?

Not an iOS developer, but curious what’s the current state of the art for distributing and storing your credentials if the app needs to make AWS service calls? Or is that considered an anti pattern, and you want to proxy all AWS calls through your own authenticated backend?