&gt; Version control is perfectly acceptable for that, but the key point is that access keys aren’t part of your production configuration.<p>Why not?  If your production configuration is stored as static-file in version control, then either those credentials have to live in that version control, or they have to live outside it, as a separately-backed up file of configuration variables, which are then fed to a static-file-generating tool, which means a) that one has to select a templating system and maintain those separate templates and b) that there&#x27;s another step involved in developing the prototypes for those templates.  This isn&#x27;t a bad course of action, of course, but it does have its costs (just like storing production configuration—including credentials—in version control has its costs as well as its benefits).<p>&gt; I personally don’t allow my team to have long-lived AWS access keys that have access to production.<p>Of course! Developers shouldn&#x27;t have access to production systems, period. But operators can, and must, and I&#x27;ve no problem with them having access to their own version-controlled repository of information that no other team can access.<p>&gt; Production is only changed via an assumed role requiring MFA or an IAM instance role.<p>Of course! I&#x27;m certainly not arguing for personal credentials to be stored in an operations repo.