diff --git a/cloudlaunch_cli/api/cloud_credentials.py b/cloudlaunch_cli/api/cloud_credentials.py
index dcbfa9d..02dbfee 100644
--- a/cloudlaunch_cli/api/cloud_credentials.py
+++ b/cloudlaunch_cli/api/cloud_credentials.py
@@ -13,12 +13,25 @@ def load_from_environment(cloud_type):
             return AWSCredentials.from_environment()
         return None
 
+    @staticmethod
+    def load_from_dict(cloud_type, creds_dict):
+        """Load a CloudCredentials subclass instance from given dict."""
+        if cloud_type == 'aws':
+            return AWSCredentials.from_dict(creds_dict)
+        return None
+
     @staticmethod
     @abc.abstractmethod
     def from_environment():
         """Load and return an instance of CloudCredentials using env vars."""
         pass
 
+    @staticmethod
+    @abc.abstractmethod
+    def from_dict(creds_dict):
+        """Load and return an instance of CloudCredentials from given dict."""
+        pass
+
     @abc.abstractmethod
     def to_http_headers(self):
         """Convert credentials to dict of http header name/values."""
@@ -41,6 +54,15 @@ def from_environment():
         else:
             return None
 
+    @staticmethod
+    def from_dict(creds_dict):
+        aws_access_key = creds_dict.get('aws_access_key')
+        aws_secret_key = creds_dict.get('aws_secret_key')
+        if aws_access_key and aws_secret_key:
+            return AWSCredentials(aws_access_key, aws_secret_key)
+        else:
+            return None
+
     def to_http_headers(self):
         return {
             'cl-aws-access-key': self.aws_access_key,
diff --git a/cloudlaunch_cli/main.py b/cloudlaunch_cli/main.py
index d4877e1..a00282a 100644
--- a/cloudlaunch_cli/main.py
+++ b/cloudlaunch_cli/main.py
@@ -9,6 +9,8 @@
 
 conf = Configuration()
 
+cli_context = {}
+
 
 def create_api_client(cloud=None, cloud_credentials_json=None):
 
@@ -16,8 +18,15 @@ def create_api_client(cloud=None, cloud_credentials_json=None):
     # Recreate client with cloud credentials if available
     if cloud:
         cloud_resource = cloudlaunch_client.infrastructure.clouds.get(cloud)
-        cloud_creds = CloudCredentials.load_from_environment(
-            cloud_resource.cloud_type)
+        # Try to load if specified on command line first, then look in
+        # environment variables
+        if 'cloud-credentials' in cli_context:
+            creds_dict = json.loads(cli_context['cloud-credentials'].read())
+            cloud_creds = CloudCredentials.load_from_dict(
+                cloud_resource.cloud_type, creds_dict)
+        else:
+            cloud_creds = CloudCredentials.load_from_environment(
+                cloud_resource.cloud_type)
         if cloud_creds:
             return APIClient(url=conf.url, token=conf.token,
                              cloud_credentials=cloud_creds)
@@ -64,8 +73,18 @@ def show_config():
 
 
 @click.group()
-def deployments():
-    pass
+@click.option('--cloud-credentials', type=click.File('rb'),
+              help="JSON file with cloud credentials.")
+def deployments(cloud_credentials):
+    """Manage CloudLaunch deployments.
+
+    You can pass cloud credentials either as environment variables or as a JSON
+    file.
+    TODO: document the expected names of variables.
+    """
+    global cli_context
+    if cloud_credentials:
+        cli_context['cloud-credentials'] = cloud_credentials
 
 
 @click.command()