We took this approach at 99designs with aws-vault and bastion accounts: https://99designs.com.au/tech-blog/blog/2015/10/26/aws-vault...