> I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner.

Clearly the solution to this is for the retail site to support IAM roles.