This is the kind of thing that keeps me up at night
If 'I'm' buying over a thousand dollars worth of instances, then I want Amazon to confirm it was actually ME before I'm billed. I also want to set limits on what and how much an AWS key can be used for. I can already do both with credit card numbers, so what's the deal here? This kind of theft seems ridiculously easy otherwise.