I wrote a simple oh-my-zsh (but should be easy to port out) plugin to improve UX of the environment variables option [0]. It's basically a very simple secrets manager, allowing one to store env variables (or whole chunks of scripts) in GPG-encrypted files and see if any secrets are sourced at the moment.
So the workflow usually looks like following:
$ secrets aws-credentials # prompts a GPG passphrase
$ aws s3 sync ...