A key file is the risky option, not the default one.

A service account is dual-natured: a principal that holds roles, AND a resource others can be granted access to act as.

Key fileIndefiniteLast resort — legacy systems with no federation support

Impersonation1 hour, on demandAny human occasionally acting as a service account

Workload Identity FederationShort-lived, per requestAny unattended automated workload — the default for new automation

One service account per workload, never a shared "does everything" identity — a shared identity always means a shared blast radius.