Amazon AWS access keys

Hey folks, a quick question for these veteran amazon affiliates out there. Have you ever used one of the 1-click-import themes or plug-ins? I was looking at a few different ones but they all seem to require that you put in your AWS access ID and secret access key. However, Amazon strongly advises against sharing those information with anyone including embedding them in third party applications. According to Amazon the access ID and secret access key can be used to see your billing information including credit card numbers etc.

Does any of this hold any truth? If so, is there a work around? Setting up amazon associates seem so painless with 1clicks imports but if it means giving free access to my credit card number to complete strangers I think I'll have to pass

Any advise?

Any way that you can read the source code of the plug before installing it to see what it does with your credentials? There are a lot of 3rd party apps that require an amazon access key and secret. I don't give mine out before I know exactly what they're being used for.

Yeah, don't use your master keys. Better set up a new IAM role with the minimum permissions the app requires.
So for example if it needs to read your S3 bucket you don't let it read and write to every bucket in your account. And if need be, you can disable just that key without messing with other apps.