> why not issue each of them identities of their own Because the easy ways of doing this are not nearly as secure as the short-lived credentials provided by th

> why not issue each of them identities of their own Because the easy ways of doing this are not nearly as secure as the short-lived credentials provided by the metadata services in these clouds. With 5-min credential expiry you can know that if a developer logs into the VM (for debugging or troubleshooting or whatever) after 5min they can no longer invisibily impersonate that role. This makes audit logging and similar much more powerful. I've frequently seen long-lived credentials being used as an alternative and this way anyone who have ever logged into any VM with that key can invisibly impersonate that service forever. You can do this by writing your own credentials manager but this is much more work, harder to make as reliable as the one provided by the IAAP provider and you still need a root of trust somewhere. Relying on the metadata service moves the root of trust to something ephemeral and managed which is highly valuable.