I think the point is less for apps, and more for the infrastructure that deploys apps (think: a Kubernetes control-plane), when that infrastructure depends on s

I think the point is less for apps, and more for the infrastructure that deploys apps (think: a Kubernetes control-plane), when that infrastructure depends on secrets from AWS but does not itself live within AWS — i.e. the "hybrid cloud" use-case. > or use the instance credentials to read from secrets manager itself Usually apps don't actually have instance credentials like this, but rather the thing deploying the app does, and that thing then injects just the secrets the app actually needs into the app's sandbox.