Glossary
Ephemeral Credential
An ephemeral credential is created for one specific, short-lived unit of work and discarded once that work finishes, rather than being provisioned once and reused across every future invocation. In an environment where the compute itself is also short-lived and stateless, this matches the credential's lifetime to the lifetime of the thing using it, instead of leaving a long-lived secret sitting in configuration that outlives any single execution by a wide margin.
The tradeoff is operational: issuing a fresh credential per invocation requires a fast, reliable issuance path, since any latency there becomes latency on every single invocation. A long-lived credential avoids that overhead entirely, at the cost of being valid for far longer than any one unit of work actually needs it to be.