At the time this project was put together, IAM didn't exist. But I agree that this would be the best approach going forward.

Yes, for this reason, and because having separate keys allows you set appropriate access controls limited to the function they are being used for.