> For example https://github.com/99designs/aws-vault/ supports one-off commands and shell sessions with pre-populated tokens.

I came to recommend aws-vault, it is pretty handy to not store aws keys in plain text.