overwrite credentials file before removing

[extra808]

from 'rm' man page: -P Overwrite regular files before deleting them. Files are overwritten three times, first with the byte pattern 0xff, then 0x00, and then 0xff again, before they are deleted.

[pda]

Sure, why not :)
It's BSD-specific; -P isn't in GNU rm, but Keychain / security is Mac OS anyway.

I actually only use aws-keychain exec <profile> <cmd …> now, so my credentials are never written to disk.

Beyond that, I'm gradually switching over to the work-in-progress https://github.com/99designs/aws-vault which never stores credentials to plaintext disk, and also uses short-lived AWS session tokens to avoid passing the master credentials into the environment of commands.

Edit: docs for exec: 67bfc8f