diff --git a/incubator/fluentd-cloudwatch/Chart.yaml b/incubator/fluentd-cloudwatch/Chart.yaml
index b2a98ab85a..0a5807bb9e 100644
--- a/incubator/fluentd-cloudwatch/Chart.yaml
+++ b/incubator/fluentd-cloudwatch/Chart.yaml
@@ -1,5 +1,5 @@
 name: fluentd-cloudwatch
-version: 0.5.1
+version: 0.5.2
 appVersion: v0.12.43-cloudwatch
 description: A Fluentd CloudWatch Helm chart for Kubernetes.
 home: https://www.fluentd.org/
diff --git a/incubator/fluentd-cloudwatch/README.md b/incubator/fluentd-cloudwatch/README.md
index 95912d6b4f..ed1d0d791c 100644
--- a/incubator/fluentd-cloudwatch/README.md
+++ b/incubator/fluentd-cloudwatch/README.md
@@ -22,8 +22,10 @@ This chart bootstraps a [Fluentd](https://www.fluentd.org/) [Cloudwatch](https:/
 To install the chart with the release name `my-release`:
 
 ```console
-$ # edit secrets/aws_access_key_id and secrets/aws_access_key_id with the key/password of a AWS user with a policy to access  Cloudwatch
+$ # use ec2 instance role credential
 $ helm install --name my-release incubator/fluentd-cloudwatch
+$ # or add aws_access_key_id and aws_access_key_id with the key/password of a AWS user with a policy to access  Cloudwatch
+$ helm install --name my-release incubator/fluentd-cloudwatch --set awsAccessKeyId=aws_access_key_id_here --set awsSecretAccessKey=aws_secret_access_key_here
 $ # or add a role to aws with the correct policy to add to cloud watch
 $ helm install --name my-release incubator/fluentd-cloudwatch --set awsRole=roll_name_here
 ```
@@ -57,6 +59,8 @@ The following table lists the configurable parameters of the Fluentd Cloudwatch
 | `annotations` (removed for now) | Annotations                                                               | `nil`                                 |
 | `awsRegion`                     | AWS Cloudwatch region                                                     | `us-east-1`                           |
 | `awsRole`                       | AWS IAM Role To Use                                                       | `nil`                                 |
+| `awsAccessKeyId`                | AWS Access Key Id of a AWS user with a policy to access Cloudwatch        | `nil`                                 |
+| `awsSecretAccessKey`            | AWS Secret Access Key of a AWS user with a policy to access Cloudwatch    | `nil`                                 |
 | `fluentdConfig`                 | Fluentd configuration                                                     | `example configuration`               |
 | `logGroupName`                  | AWS Cloudwatch log group                                                  | `kubernetes`                          |
 | `rbac.create`                   | If true, create & use RBAC resources                                      | `false`                               |
diff --git a/incubator/fluentd-cloudwatch/secrets/aws_access_key_id b/incubator/fluentd-cloudwatch/secrets/aws_access_key_id
deleted file mode 100644
index 4d7fac3bf8..0000000000
--- a/incubator/fluentd-cloudwatch/secrets/aws_access_key_id
+++ /dev/null
@@ -1 +0,0 @@
-<AWS_ACCESS_KEY_ID>
diff --git a/incubator/fluentd-cloudwatch/secrets/aws_secret_access_key b/incubator/fluentd-cloudwatch/secrets/aws_secret_access_key
deleted file mode 100644
index 41954eec7e..0000000000
--- a/incubator/fluentd-cloudwatch/secrets/aws_secret_access_key
+++ /dev/null
@@ -1 +0,0 @@
-<AWS_SECRET_ACCESS_KEY>
diff --git a/incubator/fluentd-cloudwatch/templates/daemonset.yaml b/incubator/fluentd-cloudwatch/templates/daemonset.yaml
index c02b5f077c..a82daf3ef1 100644
--- a/incubator/fluentd-cloudwatch/templates/daemonset.yaml
+++ b/incubator/fluentd-cloudwatch/templates/daemonset.yaml
@@ -40,17 +40,21 @@ spec:
         - name: LOG_GROUP_NAME
           value: {{ .Values.logGroupName }}
 {{- if not .Values.awsRole }}
+{{- if .Values.awsAccessKeyId }}
         - name: AWS_ACCESS_KEY_ID
           valueFrom:
             secretKeyRef:
-              key: aws_access_key_id
+              key: AWS_ACCESS_KEY_ID
               name: {{ template "fluentd-cloudwatch.fullname" . }}
+{{- end }}
+{{- if .Values.awsSecretAccessKey }}
         - name: AWS_SECRET_ACCESS_KEY
           valueFrom:
             secretKeyRef:
-              key: aws_secret_access_key
+              key: AWS_SECRET_ACCESS_KEY
               name: {{ template "fluentd-cloudwatch.fullname" . }}
 {{- end }}
+{{- end }}
 {{- range $env := .Values.extraVars }}
         - {{ $env  }}
 {{- end }}
diff --git a/incubator/fluentd-cloudwatch/templates/secrets.yaml b/incubator/fluentd-cloudwatch/templates/secrets.yaml
index f244253645..1cdfd4ea2d 100644
--- a/incubator/fluentd-cloudwatch/templates/secrets.yaml
+++ b/incubator/fluentd-cloudwatch/templates/secrets.yaml
@@ -10,5 +10,10 @@ metadata:
     release: {{ .Release.Name }}
 type: Opaque
 data:
-{{ (.Files.Glob "secrets/*").AsSecrets | indent 2 }}
+{{- if .Values.awsAccessKeyId }}
+  AWS_ACCESS_KEY_ID: {{ .Values.awsAccessKeyId | b64enc }}
+{{- end }}
+{{- if .Values.awsSecretAccessKey }}
+  AWS_SECRET_ACCESS_KEY: {{ .Values.awsSecretAccessKey | b64enc }}
+{{- end }}
 {{- end }}
diff --git a/incubator/fluentd-cloudwatch/values.yaml b/incubator/fluentd-cloudwatch/values.yaml
index 1b9e96e691..367c086bb3 100644
--- a/incubator/fluentd-cloudwatch/values.yaml
+++ b/incubator/fluentd-cloudwatch/values.yaml
@@ -29,6 +29,8 @@ annotations: {}
 
 awsRegion: us-east-1
 awsRole:
+awsAccessKeyId:
+awsSecretAccessKey:
 logGroupName: kubernetes
 
 rbac: