Stack events currently retrieve system users credentials from S3.
shinesolutions/aem-aws-stack-builder#21 will move the location of these credentials to parameter store, so after that's completed, credentials retrieval in aem-tools have to be updated accordingly.
This will also depend on the direction of #6 . It's possible that parameter store integration will be supported by that aem-tools app instead of handled via shell.