Author of post and aws-vault tool here. There is absolutely a short window of time when it's possible to steal an unlocked machine and have full access to the u

Author of post and aws-vault tool here. There is absolutely a short window of time when it's possible to steal an unlocked machine and have full access to the unlocked keychain. The same issue exists for Keychain itself and things like ssh-agent. The idea is to reduce the attack surface, as you said, and to practice principle of lease privilege. Create roles for specific use cases with just the required permissions, and assume them as needed, based on credentials stored encrypted at rest. It's doesn't solve everything, but it's considerably better than the alternatives AWS offers the concept of Power Users, which have access to everything except IAM. We use them for most things, which mitigates the risk of an attacker escalating temporary access into long term access. They can still cause a lot of damage, but it's time limited.