Hey @KnightPista, I know this is a super late response so I doubt you’ll ever see this, but you are absolutely right. There is a huge security flaw with the tutorial that I linked in the original post. Directly embedding root AWS account credentials (access and secret access keys) into a packaged Unreal Engine project is very risky, so I would only use this tutorial for testing with small controlled groups of users. And you are also right that hackers can use those credentials to spam certain GameLift functions/commands, which can absolutely cost someone a lot of money.
As a result, I decided to update my tutorial series to follow AWS best practices. One of which is instead of using root aws account credentials, I authenticate clients using a Cognito user pool and give them a set of temporary Cognito user pool tokens that can be used to invoke an API on Amazon API Gateway using http requests. These requests to various API methods will invoke specific AWS Lambda functions that communicate with different AWS services, including GameLift. Therefore, the client is no longer directly calling AWS functions, rather, they are going through a client service that checks who is making the request before performing any AWS-related action. And through this client service is how clients end up connecting to a UE4 server hosted on GameLift. Also, another benefit of a client service is that clients are not authorized to directly perform certain AWS functions/commands like creating a game session, but they are only authorized to invoke this client service, which you can customize to have certain checks and balances like preventing the same user from making too many matchmaking requests at a time for example in order to give you more control over what clients can and can not do.
Ultimately I go over these concepts and more that go into making a multiplayer game using Unreal Engine and Amazon GameLift in a new tutorial series that can be found here in the hopes that multiplayer development with AWS can become easier to understand. I also made a new forum post that outlines in more detail each part of the tutorial.
Lastly, as for GameLift Realtime Servers, I have heard about these but I have to do more research on them. It’s on my long todo list of things that I want to cover on my YouTube channel.