We faced a similar problem here at Etleap. Our current setup involves two sets of credentials for everyone, one more limited and one less limited. Same idea for

We faced a similar problem here at Etleap. Our current setup involves two sets of credentials for everyone, one more limited and one less limited. Same idea for database accounts. Most of the time we only need basic monitoring access (got a cloudwatch alert, did something not restart properly?) which we use the more limited account. All the commands are logged and centralized (in case of intruders as well as so that we know what happened if someone fat-fingered something). API tokens are encrypted on disk with KMS and the encrypted files are not readable by our user accounts. We've never had to restore database locally so I don't have anything to suggest.