diff --git a/.ci/Jenkinsfile b/.ci/Jenkinsfile
index 4ce959627e..14cbc46648 100644
--- a/.ci/Jenkinsfile
+++ b/.ci/Jenkinsfile
@@ -279,18 +279,6 @@ def withKubernetes(Closure body) {
 
 def withCloudTestEnv(Closure body) {
   def maskedVars = []
-  // AWS
-  def aws = getVaultSecret(secret: "${AWS_ACCOUNT_SECRET}").data
-  if (!aws.containsKey('access_key')) {
-    error("${AWS_ACCOUNT_SECRET} doesn't contain 'access_key'")
-  }
-  if (!aws.containsKey('secret_key')) {
-    error("${AWS_ACCOUNT_SECRET} doesn't contain 'secret_key'")
-  }
-  maskedVars.addAll([
-    [var: "AWS_ACCESS_KEY_ID", password: aws.access_key],
-    [var: "AWS_SECRET_ACCESS_KEY", password: aws.secret_key],
-  ])
   // GCP
   withGCPEnv(secret: env.ELASTIC_PACKAGE_GCP_SECRET) {
     maskedVars.add([var: 'GOOGLE_CREDENTIALS', password: readFile(file: env.GOOGLE_APPLICATION_CREDENTIALS)]);
@@ -298,7 +286,10 @@ def withCloudTestEnv(Closure body) {
   }
   // Masking
   withEnvMask(vars: maskedVars) {
-    body()
+    withSecretVault(secret: "${AWS_ACCOUNT_SECRET}",
+                    data: ['access_key': 'AWS_ACCESS_KEY_ID', 'secret_key': 'AWS_SECRET_ACCESS_KEY']) {
+      body()
+    }
   }
 }