We don't use AWS Key and instead use cross-account IAM role with read-only permissions. We use CloudFormation to create this IAM role.