Support

As you might have guessed, anyone with Configuration access to the site will be able to see the Amazon S3 key. Do note that the information is stored in the database encrypted, so they can't be simply dumped by an attacker, but anyone with access to Akeeba Backup's Configuration page can see them. There are two different workarounds:

1. If you control the sites, you can use the Access Control feature of Akeeba Backup to forbid access to the configuration for everyone except yourself. However, if someone simply creates a new Super Administrator they'll be able to get the Amazon keys.

2. (Recommended). Create a new Amazon AWS user (it's free) and give him write only access to your bucket. You can optionally set up IAM policies like this user did for added security. So, even if someone does get hold of the access keys he will only be able to write to the bucket, not download backup files.

You're welcome!