Best practice for AWS resources such as EC2 / Lambda / etc is to use IAM roles, detailed here. In short you don't create a user for a server, you create a role that the service can assume that has a set of permissions which is associated with the EC2 server.
That server with a role is given "temporary" credentials when it's running so it can access ...
First of all you need predefined access policies to resources (like SQS,EC2,ElastiCache etc). After that you can add user with programmatic access and store credential in safe way or use Roles to assign it to services for access. For example: create IAM role to access RDS and assign it to ec2 instance, then try to access our database from ec2 instance.
AWS defines some policies that are available in every account. As new services are added these policies are updated so the policy always has read only access. Some of them are job function policies, some are mmore general.
The most relevant ones are:
ReadOnlyAccess ( https://console.aws.amazon.com/iam/home#policies/arn:aws:iam::aws:policy/ReadOnlyAccess )