When you run with multiple AWS accounts, regions, and permissions, the CLI ~/.aws/config and ~/.aws/credentials files become your lifeline. They keep access keys, secret keys, and session tokens within easy reach. They also store metadata that—if not handled carefully—can clash hard with GDPR compliance.
GDPR isn’t just about storing personal data in databases. It covers any personal data in any format, including logs, config files, and temporary credentials that can point back to individuals. AWS CLI–style profiles seem harmless, but they can hold direct identifiers, audit trails, and keys tied to a single person’s IAM account. If those profiles sync to shared machines, unmanaged backups, or developer laptops without encryption, you’re one leak away from a breach that falls squarely under GDPR enforcement.
The fixed mindset of “it’s just my local dev setup” is why so many compliance failures happen. Every stored credential is personal data if it identifies an individual. Deleted from AWS? Still on disk. Rotated at the IAM level? Still in your shell history. Stale profiles stored for months in cloud-backed home folders trigger GDPR’s storage limitation principle.