This sounds like your standard startup-y security stack. Bonus points for trying to use your cloud provider's hardware key storage and keeping secrets in 1password. It ain't great but you could do worse.

(I've worked at startups and we did better. No access to the cloud provider without a time-based escalation. Secrets in secrets managers. Passwords rotated regularly. Mandatory 2FA. Signed commits. But it would probably still look god-awful if we were a finance company!)