1. Why do we need two seperate ServiceAccounts when configuring cicd pipelines (cicd SA and IaC SA)
- Having seperate service accounts helps shutdown the pipeline incase of any issues and still keep IaC SA and ability to run terraform plan/apply manually.
- A pipeline can only generate a token that can get access to an SA. It cannot directly call a provider file to impersonate IaC SA.
- Having providers file that allows impersonation to IaC SA allows flexibility to run terraform manually or from CICD Pipelines.