Never use root access keys in your website, that's a bad idea. If a plugin requires too much permission, I simply don't use it. Only use IAM credentials with minimal permissions, that's what the policies are for.

Very expensive mistake,Too bad with AWS you only get billing alerts but no complete shutdown when reaching a quota.