After creating a service account with a key, it can be used in a policy to grant permissions to any Control Plane resource. Once permissions have been granted, a browser-less CLI login is performed to authenticate and allow the execution of CLI commands.