Yet here you are, juggling text files, sticky notes, and scattered environment variables, trying to secure infrastructure with a toolchain designed for trust. AWS CLI-style profiles made it easy to switch environments, but they were never built for zero trust. The world has moved. Attack surfaces grow with every merged PR. Access must be temporary, targeted, and always verified.
Zero trust flips the default from “assume safe” to “prove safe.” AWS CLI profiles assume your local machine is safe. They assume that once you have a profile, you are who you say you are. That’s dangerous. If a token, profile file, or role configuration is compromised, an attacker can walk right in without challenge. Zero trust says: no one walks in without being checked every time.
This means profiles must be dynamic. Credentials must be short-lived. Access paths must be verifiable, auditable, and immediately revocable. Static ~/.aws/credentials files are dead weight in this model. Instead, you need an access layer that issues just-in-time credentials for each command, where every request is bound to your identity and the current security posture of your machine.
The shift comes down to three rules: