Instead of encouraging privileged long term creds, we should encourage long term creds with permissions only to assume an IAM role. Even better if we can restrict them to only GitHub action runner IP ranges.