you should provision jit creds via sts - I think default session length if 1hr. dont use hard coded keys and use IRSA.