Workload identities: instance roles, managed identities and service accounts instead of stored keys

Applications need to call cloud APIs too: a web server reads from object storage, a function writes to a queue, a pipeline deploys infrastructure. The old way was to create a user, generate a long-lived access key and put it in a configuration file or environment variable. Those keys leak constantly, through code committed to public repositories, container images, logs and backups, and they often stay valid for years.