diff --git a/pkg/storage/s3/s3.go b/pkg/storage/s3/s3.go
index 7c29aee3..bf29a168 100644
--- a/pkg/storage/s3/s3.go
+++ b/pkg/storage/s3/s3.go
@@ -36,6 +36,9 @@ func New(s3Conf *config.S3Config, timeout time.Duration, options ...func(*aws.Co
 	const op errors.Op = "s3.New"
 
 	awsConfig := defaults.Config()
+	// remove anonymous credentials from the default config so that
+	// session.NewSession can auto-resolve credentials from role, profile, env etc.
+	awsConfig.Credentials = nil
 	awsConfig.Region = aws.String(s3Conf.Region)
 	for _, o := range options {
 		o(awsConfig)