credctl vs aws-vault: When to Use Each
aws-vault keeps your long-lived AWS keys encrypted in the OS keychain and hands out short-lived STS sessions. credctl replaces the long-lived keys entirely with hardware-bound OIDC federation. Here’s an honest comparison.