The only one I've thought of since writing this is to have a separate AWS account and link it as a sub account for billing. Solves someone shutting down your main servers, but still means they can spin stuff up / use lots of cash. This would be a massive pain for us as we'd loose our worker pool. I could do it the other way, move our infrastructure to a new account...but that sounds equally painful.

I would like to see IAM as well, but I would say that the solution right now is using a seperate account and using AWS MFA:

http://aws.amazon.com/mfa/

A new account doesn't have all AWS services enabled by default, so the impact seems minimal to start with. Not sure if you can lock this down further as I haven't looked into it.

All in all this is not perfect, but "securer".

Or have it charged to an entirely separate card, one that gets reloaded with money every month to cover planned MT expenses. Annoying, but the safest option, I suspect