I'm a big fan of aws-vault [1], which helps securely store your tokens and use them to obtain temporary credentials which are time-limited and constrained to a

I'm a big fan of aws-vault [1], which helps securely store your tokens and use them to obtain temporary credentials which are time-limited and constrained to a specific IAM role. It's not as good as having something that supports a hardware token, of course, but it's better than the default awscli suggestion to keep the secrets around in plaintext either on disk or in env vars. [1] https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault