Regarding 1, my own cli runs aws-vault set-up such that I need to enter a totp code to assume a privileged role.
It sounds like really basic security - my saved credential can't go delete servers. Absolutely everyone, from aws certified people to apparently renowned developers have gotten stuck into me over this, with complaints from "I'd quit anywhere that did that" to "bad setup, proper iam never requires mfa". I'm sure there's going to be some form of blow up where long term saved credentials eventually come out as problematic, and it will blow people's minds.
It sounds like really basic security - my saved credential can't go delete servers. Absolutely everyone, from aws certified people to apparently renowned developers have gotten stuck into me over this, with complaints from "I'd quit anywhere that did that" to "bad setup, proper iam never requires mfa". I'm sure there's going to be some form of blow up where long term saved credentials eventually come out as problematic, and it will blow people's minds.