AWS should setup keys for each service. Example if you only want a CDN you get X key, and if you want EC2 you get X2 key. That way if someone gets your key lets say from a plugin they will only have access to that part of AWS.