Vault-Backed Dynamic Credentials
developer.hashicorp.com
developer.hashicorp.com
It's pretty hidden within vault, only mentioned on a couple provider pages, whereas I feel like it should be the main thing - you set up ephemeral secrets for everything, falling back to static credentials only for services that don't support it.
Edit: Infisical supports it, AWS and Oracle Cloud only though: https://github.com/Infisical/infisical/blob/18c0d2fd6f31a3db...