We don't check that the user is still a member of the tenant (project) so the ec2 (or s3) token still works
We don't check that the user is still a member of the tenant (project) so the ec2 (or s3) token still works