I'd like to add two more:
1) Not giving out your access and secret keys in scripts/buckets.
2) Always using IAM roles with your EC2