In the new STS mode (cf. https://issues.redhat.com/browse/CCO-366), CCO creates/updates the target Secret depending on its existence - the Secret is created iff it does not exist yet. Under the hood (https://github.com/openshift/cloud-credential-operator/blob/0c629a5d0fcd1065ad6bda6a8d03976090178af4/pkg/operator/credentialsrequest/credentialsrequest_controller.go#L671) either the Create() or the Update() function is called.

The two aforementioned functions does the same thing as they both call the same sync function, in which CCO tries to createSTSSecret(). 

However this createSTSSecret() function fails when the target Secret already exists. So the target Secret cannot be updated.