diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f3c81e..68d6f95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,11 @@
+# Unreleased changes
+## Fixes
+- Allow `sql.s3_to_postgres()` to rely on an IAM role by omitting `aws_commons.create_aws_credentials()` when the S3 connection has no login or password.
+
 # ea_airflow_util v0.4.1
 ## Fixes
 - Explicitly pass `bucket_name` into all method calls to `S3Hook`.
 
-
 # ea_airflow_util v0.4.0
 ## New features
 - Add `snowflake_keypair` callable for generating Snowflake RSA keypairs and rotating Snowflake user public keys.
diff --git a/ea_airflow_util/callables/sql.py b/ea_airflow_util/callables/sql.py
index 1d07c97..fd9e523 100644
--- a/ea_airflow_util/callables/sql.py
+++ b/ea_airflow_util/callables/sql.py
@@ -96,13 +96,17 @@ def s3_to_postgres(
     elif truncate and delete_qry:
         raise ValueError('Only specify one of truncate, delete_qry')
 
+    aws_credentials = ''
+    if s3_creds.login or s3_creds.password:
+        aws_credentials = f""",
+        aws_commons.create_aws_credentials('{s3_creds.login}', '{s3_creds.password}', '')"""
+
     copy_qry = f"""
         select aws_s3.table_import_from_s3(
         '{dest_table}',
         '{column_customization}',
         '{options}',
-        aws_commons.create_s3_uri('{s3_bucket}', '{s3_key}', '{s3_region}'),
-        aws_commons.create_aws_credentials('{s3_creds.login}', '{s3_creds.password}', '')
+        aws_commons.create_s3_uri('{s3_bucket}', '{s3_key}', '{s3_region}'){aws_credentials}
         );
     """