For a layer of security, when using the client you could do IAM role assumption in your local machine. You have your static creds and an MFA device, then use th

For a layer of security, when using the client you could do IAM role assumption in your local machine. You have your static creds and an MFA device, then use those to export temporary credentials to actually run the bless client. http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html http://docs.aws.amazon.com/STS/latest/APIReference/API_Assum... Some tools to make the process easier: https://github.com/remind101/assume-role https://github.com/remind101/assume-role https://github.com/trek10inc/awsume https://github.com/trek10inc/awsume