Long-lived keys are a secret you have to store somewhere.

IAM is RBAC's cloud-level counterpart — same least-privilege principle. Workload identity removes the stored-credential risk entirely.

before — s3:* on *

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

after — scoped to one bucket

{
  "Effect": "Allow",
  "Action": ["s3:GetObject"],
  "Resource": "arn:...:checkout-assets/*"
}

Workload identity

Automatically issued, automatically rotated, short-lived (often ~1 hour), fetched on-demand from a metadata service — never stored anywhere at all for an attacker to find.

Prefer workload identity wherever the platform supports it — there's nothing sitting in a config file for an attacker to leak.