Why are Managed Identities preferred over Service Principals with client secrets? (AWS analogy: IAM roles vs long-lived access keys.)

A Managed Identity is a service principal whose credentials Azure fully manages — nothing to store in config, rotate, or leak. It solves the same problem IAM roles solve versus long-lived access keys on AWS.