While not exactly "code quality," recommending the use of static AWS credentials is an antipattern now that both GitHub and GitLab have working JWT implementati

While not exactly "code quality," recommending the use of static AWS credentials is an antipattern now that both GitHub and GitLab have working JWT implementations that make `AssumeRoleWithWebIdentity` work correctly, and is supported by all modern aws sdks (including, of course, terraform). One can even configure that exclusively via env-vars so local `terraform plan` works using local credentials, and then the GitHub/GitLab plan uses the ARWWI flow We actually have an SCP that `Deny`s `iam:CreateAccessKey` in our Organization(s)