A company is building an agent that reads each employee's calendar in a third-party scheduling service, with the employee's consent. The security team forbids storing API keys or passwords in the agent's code or configuration files. Which AWS capability fits BEST?