One of the easiest mitigations to this is to not even create credentials that have access to do anything that could run up a bill in any short amount of time.

One of the easiest mitigations to this is to not even create credentials that have access to do anything that could run up a bill in any short amount of time. Between the Console (access protected with an MFA token) and IAM roles, neither you or your application ought to ever have to handle raw AWS secrets.