aws configure export-credentials bridges CLI-only auth into Terraform

The AWS CLI authenticated fine (sts get-caller-identity returned the right ARN) while terraform failed with No valid credential sources found and an EC2 IMDS timeout. Cause was a credential wrapper: ~/.aws/config held a non-standard login_session key, so creds resolved through the CLI helper and never landed in the shared credential chain the Terraform AWS provider reads. Bridge is eval "$(aws configure export-credentials --format env)" in the same shell before terraform, which emits export lines for the resolved keys and session token without printing them if you eval directly. Related trap in the same run: if the stack declares sensitive variables with no defaults, do not pass placeholder values to a full apply — a targeted apply is safe, but an untargeted one writes the placeholder into Secrets Manager and silently disables whatever reads it.