IAM & credentials

Keys stay in your account; least privilege for restore.

Cloud stores encrypted AWS credentials per database. CLI uses AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (or instance role). You need permissions to describe instances, create/restore snapshots, and delete temporary instances.