Customer's IT team wants to deploy in their VPC but won't give production credentials

Don't fight the constraint — fold it into the design. Propose a deployment model where your team never holds production credentials: deploy via the customer's own Terraform / Pulumi pipeline, run automated integration tests against a sandbox tenant, and ship via a customer-owned CI/CD with break-glass only on the customer's side. Reference any prior deployment experience with restricted-access deployments. Offer to write a "least-privilege access model" document jointly with the customer's security team.