This is the best tool I've found so far to manage profiles securely and switching roles between the ~35 accounts im working with right now.
One thing I would point out is that by default it will timeout the session in 4h and the role in 15m. This means that every 15m you will need to exit your bash shell that aws-vault exec created, or replace the env vars you generated. Set the two env vars for session and role ttl to your desired values in your bash profile to avoid setting them on the cli on every invocation.
You just want to look at this file, as the env vars are not documented. https://github.com/99designs/aws-vault/blob/4acbb48b48b90555...
I'd like to employ the tool to support local development on a containerized web application. The assume role TTL may prove to be the real issue, so I need to weight the tradeoff of allowing a longer life on the STS keys. I suppose I could set up a profile without a role and override the AWS_PROFILE environment variable within docker-compose. And I know that aws-vault also supports the virtual meta-data service.
Either way, the benefit of something like aws-vault extends beyond security. We've discovered numerous inconsistencies with the profile-based credential handlers in the Java API (https://github.com/aws/aws-sdk-java/issues/803) which beg for a simpler solution in terms of supporting developers.