Comment by gz09

> A human, you can hold accountable, and you can keep them at a good security posture with short-lived session tokens.

You can do this too (and better) with a repo: OIDC/Workload identity trust relationship between github and aws for short lived tokens + a github environment setup that requires manual approval. Bonus: It also gives you an audit trail with a github action log as opposed to a sysadmin running something on a laptop.

The problem here was mostly that they (for some reason) happened to use (and leak) a PAT.