reactjs – How to securely handle AWS credentials in React app using DynamoDB SDK

I have a React application that directly connects to DynamoDB using the AWS SDK V3. Currently, the AWS credentials are stored in environment variables (.env), but I’ve discovered they’re exposed to the client side.

The DynamoDB calls are extensively used throughout the application, making it time-consuming to migrate everything to API Gateway + Lambda.
I’m considering these temporary solutions:

Using a proxy server to inject AWS Signature V4
Implementing CloudFront Functions as middleware
Using Lambda@Edge

Technical constraints:

Need to maintain existing DynamoDB SDK calls
Must handle AWS Signature V4 authentication
Should minimize client-side exposure of credentials

What would be the most secure and efficient way to implement a temporary solution while planning a proper architectural change?