That sucks, but it's an important lesson. Along with keeping them hidden, you should use IAM credentials that have specific access policies instead of your root credentials. You can specifically state what they have access to, for example you can restrict access to read only, or to a specific service like S3. At least the damage can be contained, in this instance spinning up servers on EC2 would not have been possible.

IAM info: http://docs.aws.amazon.com/IAM/latest/UserGuide/PoliciesOverview.html