A good practice to enforce (if you can) is to only share credentials with your coworkers if they're gpg encrypted. e.g. coworker asks for password to some AWS box? encrypt it to their GPG key and email it to them.

- coworker asks for password to some AWS box?

To be clear, GPG encrypted is better than plain text for all sorts of secrets, but using a single account and passing around passwords won't scale. (Or rather the security implications of everybody having root access via a single shared account and passing the password around should frighten you.)

Ideally there's some sort of mechanism so all users can login to their own account on servers (from puppetized ssh keys to LDAP, among others), and no one is actually passing around passwords.