[jes5199]

I have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?

[prattbhatt]

Yes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.

[ceejayoz]

Which is why most things should be done with IAM keys specifically locked down to minimal privileges.

[jes5199]

Apparently I have access keys that predate the release of IAM ! Fortunately there's a convenient "disable" link on security keys page.

[prattbhatt]

Agreed