Legally you're not liable for something someone does while impersonating you This unfortunately isn't true. It also sounds like he created an app key from his

Legally you're not liable for something someone does while impersonating you This unfortunately isn't true. It also sounds like he created an app key from his root account that enabled anyone to literally impersonate him. A typical use case is to create a user that has only the specific rights that are needed and generate an app key for that user. For example, I have a user that can only read S3 buckets. If it were to leak, the worst that would happen is I would leak some encrypted backup data.