Yes that's correct. I use a specific key for only allowing DNS updates to be applied to "example.com" and no other domain, for example. As others have mention

Yes that's correct. I use a specific key for only allowing DNS updates to be applied to "example.com" and no other domain, for example. As others have mentioned the billing alerts are also a useful thing, along with the IAM Simulator.