This message was deleted.

This depends on your threat model and security requirements. The second approach is more secure, but as you already noted, maintaining is difficult. The first is far less secure, but if you carefully control access, log, and audit the use of that role, it can be okay. Both are valid, but have different tradeoffs. I will say it’s likely far more common to see a single over-privileged role running their IaC in CI/CD