A cloud provider supports short-lived workload identity for HCP Terraform. Why prefer it to a long-lived static secret?

1. It makes state universally safe to publish
2. It guarantees resource configurations are correct
3. It reduces persistent credential exposure
4. It removes all authorization policy requirements