diff --git a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
index ea2b1757..68cd650b 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
@@ -39,7 +39,6 @@ import org.springframework.vault.authentication.AppRoleAuthenticationOptions.App
 import org.springframework.vault.authentication.AppRoleAuthenticationOptions.RoleId;
 import org.springframework.vault.authentication.AppRoleAuthenticationOptions.SecretId;
 import org.springframework.vault.authentication.AwsEc2AuthenticationOptions.AwsEc2AuthenticationOptionsBuilder;
-import org.springframework.vault.authentication.AwsIamAuthenticationOptions.AwsIamAuthenticationOptionsBuilder;
 import org.springframework.vault.authentication.AzureMsiAuthenticationOptions.AzureMsiAuthenticationOptionsBuilder;
 import org.springframework.vault.authentication.CubbyholeAuthenticationOptions.CubbyholeAuthenticationOptionsBuilder;
 import org.springframework.vault.authentication.KubernetesAuthenticationOptions.KubernetesAuthenticationOptionsBuilder;
@@ -389,11 +388,7 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration im
 		Assert.isTrue(StringUtils.hasText(role),
 				"Vault AWS-IAM authentication: Role (vault.aws-iam.role) must not be empty");
 
-		AwsIamAuthenticationOptionsBuilder builder = AwsIamAuthenticationOptions.builder()
-			.role(role)
-			.credentialsProvider(DefaultCredentialsProvider.create());
-
-		return new AwsIamAuthentication(builder.build(), restOperations());
+		return AwsIam.doCreateIamAuthentication(role, restOperations());
 	}
 
 	protected ClientAuthentication azureMsiAuthentication() {
@@ -491,4 +486,18 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration im
 
 	}
 
+	static class AwsIam {
+
+		static ClientAuthentication doCreateIamAuthentication(String role, RestOperations restOperations) {
+
+			AwsIamAuthenticationOptions.AwsIamAuthenticationOptionsBuilder builder = AwsIamAuthenticationOptions
+				.builder()
+				.role(role)
+				.credentialsProvider(DefaultCredentialsProvider.create());
+
+			return new AwsIamAuthentication(builder.build(), restOperations);
+		}
+
+	}
+
 }