Hacker News Reader

Yes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.

Which is why most things should be done with IAM keys specifically locked down to minimal privileges.

Agreed

Apparently I have access keys that predate the release of IAM ! Fortunately there's a convenient "disable" link on security keys page.