A financial services company is building a RAG application on Amazon Bedrock Knowledge Bases. Their platform team already operates a managed Pinecone vector database that other internal ML workloads depend on, and they want to reuse it as the vector store for their new knowledge base to avoid running a second vector infrastructure. The security team requires that the Pinecone API credentials never be stored in application code or environment variables. Which approach correctly integrates Pinecone as the vector store while meeting the credential requirement?