But then you need creds to access AWS SSM, Vault, etc., and those end up getting stored the same way the actual creds you needed were being stored, and you're back at square one.

Nah you can get machine creds automatically via the metadata service when running inside AWS. Nothing need be on disk.