I stumbled upon https://github.com/pda/aws-keychain.
The aim of aws-keychain is to run commands that require AWS credentials without ever storing those credentials unencrypted on disk. Mac OS X's keychain is used for storage, and credentials are passed to commands via the well known environment variables that all tools look for.
I thought it was pretty cool, but it made me wonder if the trouble was worth it. The only way someone would ever have access to those keys would be if they gained physical access to your computer, and at that point, you're screwed to the point where it'd be safer to invalidate those keys anyways.
It's not that I think it's a bad idea, but it seems like a marginal security improvement at best. Am I missing something?