It's possible to authenticate to a database using AWS IAM role. The same should be possible for the Admin API.

The problem with the API keys is that they can be taken away and used elsewhere. They pose an additional risk in an AWS integrated environment.

This also relates to upcoming Cloudformation Resources where the extension needs to store the API Key in AWS Secrets Manager. The resource already has a role that could simply be configured to be trusted on the Atlas side.