> A human, you can hold accountable, and you can keep them at a good security posture with short-lived session tokens.

You can do this too (and better) with a repo: OIDC/Workload identity trust relationship between github and aws for short lived tokens + a github environment setup that requires manual approval. Bonus: It also gives you an audit trail with a github action log as opposed to a sysadmin running something on a laptop.

The problem here was mostly that they (for some reason) happened to use (and leak) a PAT.

> Besides, one repository holding all the IaC stuff? That just sounds like hour long `terraform refresh` sessions.

If it is terraform, then typically it's split up into multiple "root modules" which get planned and applied separately, even though it's all in one repo.