How are people working around the issue of specifying a profile for awskms as secrets provider without providing an env variable for the underlying aws cli? Or is that the only way to work it right now?