Impersonation is the default, not the exception.

Short-lived, audit-friendly credentials replaced the standing key.

CallerHolds roles/iam.serviceAccountTokenCreator

RequestIAM Credentials API issues a token

Token1 hour default, 12 hour max

Audit logRecords both caller AND impersonated identity

An older project's default Compute Engine service account still carried a legacy broad role, discovered only during a machine-type migration. Purpose-scoped service accounts, always — never the default.