I wrote a simple oh-my-zsh (but should be easy to port out) plugin to improve UX of the environment variables option [0]. It's basically a very simple secrets manager, allowing one to store env variables (or whole chunks of scripts) in GPG-encrypted files and see if any secrets are sourced at the moment.

So the workflow usually looks like following:

  $ secrets aws-credentials  # prompts a GPG passphrase
  $ aws s3 sync ...

[0] https://github.com/chuwy/zsh-secrets