I’m utilizing gitlab’s opentofu CICD component to good effect.. BUT noticing it’d be nice to keep my cloud credentials protected .. but smooth out the merge_request pipeline (which is not protected and fails on TF PLAN command)

Is there some good way to either protect the merge_request pipeline OR skip the tf plan stage?

variables:
  TF_VAR_REGION: "sweden central"
  TF_VAR_PROJECT_NAME: "myproject"
  TF_VAR_ENVIRONMENT: "$CI_COMMIT_REF_NAME"
  TF_STATE_NAME: ""

before_script:
  - |
    if [ "$CI_COMMIT_REF_NAME" == "main" ]; then
      export TF_VAR_ENVIRONMENT="prd"
      export TF_STATE_NAME="prd"
    elif [ "$CI_COMMIT_REF_NAME" == "staging" ]; then
      export TF_VAR_ENVIRONMENT="tst"
      export TF_STATE_NAME="tst"
    else
      export TF_VAR_ENVIRONMENT="dev-${CI_COMMIT_REF_NAME,,}"
      export TF_STATE_NAME="dev-${CI_COMMIT_REF_NAME,,}"
    fi

include:
  - template: Security/SAST.gitlab-ci.yml
  - component: $CI_SERVER_FQDN/components/opentofu/[email protected]
    inputs:
      version: 0.25.0
      root_dir: terraform

stages: [validate, test, build, deploy, cleanup]

As you can seee TF Plan fails on merge requets

OpenTofu has been successfully initialized!
Planning failed. OpenTofu encountered an error while generating this plan.
╷
│ Error: No valid credential sources found
│ 
│   with provider["registry.opentofu.org/hashicorp/aws"],
│   on provider.tf line 2, in provider "aws":
│    2: provider "aws" {
│ 
│ Please see https://registry.terraform.io/providers/hashicorp/aws
│ for more information about providing credentials.
│ 
│ Error: failed to refresh cached credentials, no EC2 IMDS role found,
│ operation error ec2imds: GetMetadata, request canceled, context deadline
│ exceeded
│ 
╵