diff --git a/doc/030_preparing_a_new_repo.rst b/doc/030_preparing_a_new_repo.rst
index 37edb00fe..0ba592051 100644
--- a/doc/030_preparing_a_new_repo.rst
+++ b/doc/030_preparing_a_new_repo.rst
@@ -249,6 +249,14 @@ while creating the bucket.
     $ export AWS_ACCESS_KEY_ID=<MY_ACCESS_KEY>
     $ export AWS_SECRET_ACCESS_KEY=<MY_SECRET_ACCESS_KEY>
 
+Restic can also read credentials from an AWS shared credentials file. Set
+``AWS_SHARED_CREDENTIALS_FILE`` to its path, or use the default location at
+``~/.aws/credentials``. When running restic in a container, mount the file
+read-only and set ``AWS_SHARED_CREDENTIALS_FILE`` to the path inside the
+container. Avoid passing secret values in ``docker run -e NAME=value``
+arguments, where they can be exposed in process listings. Docker's
+``--env-file`` option also keeps the values out of command-line arguments.
+
 When using temporary credentials make sure to include the session token via
 the environment variable ``AWS_SESSION_TOKEN``.