Adding to existing suggestions.

- About 5, https://github.com/99designs/aws-vault is super handy to keep AWS credentials encrypted.

- Use full-disk encryption as a team policy.

- About 7, it is likely that this is solved by having preview environments so that developers don't need to manage infrastructure manually.

- About 8, 1password shared vault works nicely for us.