We now obtain credentials based on the container task's role rather than just relying on the credentials of the enclosing container instance. Fixes #6700.
