AWS Credential Isolation for Local AI Agents

How to give a local coding agent exactly the AWS access it needs, nothing more, using elhaz