[prattbhatt]

Yes, someone with your access and secret keys can spin up instances, create buckets, and do everything else that the stolen keys are authorized for.

[ceejayoz]

Which is why most things should be done with IAM keys specifically locked down to minimal privileges.

[jes5199]

Apparently I have access keys that predate the release of IAM ! Fortunately there's a convenient "disable" link on security keys page.

[prattbhatt]

Agreed