I don't have a specific best-practice answer but you could invoke a back-end method which fetches the AWS credentials from Secrets Manager (using a baked-in access key), thereby hiding them from the front-end?

Worth taking a look at the AWS WAF (Well-Architected Framework) as this will give you some AWS-approved architecture ideas.