What about ps? about aws-keychain

[pda]

When you run aws-keychain exec ... the command will be in ps, along with the token.

Got an example of that happening? I think you'll find the environment passed to the command is not exposed to unprivileged users via ps.

Why not simply put them in ~/.aws/credentials, where they should be.

Because then the secrets are stored in plaintext while at rest on disk. Keeping them encrypted in Keychain adds layer of security, if not a perfect one. If that's not enough, see https://github.com/99designs/aws-vault for a more involved take on this, including generating time-limited session credentials.