Long-lived keys are a secret you have to store somewhere

Applies least privilege to cloud IAM with a before/after policy example, and explains why workload identity beats static access keys.