Use this command to install AWS Vault with WinGet:
winget install --id=ByteNess.AWSVault -e
AWS Vault is a tool designed to securely store and manage AWS credentials in a development environment. It stores IAM credentials in your operating system's secure keystore and generates temporary credentials for use with shells and applications, ensuring enhanced security by reducing the risk of credential exposure.
Key Features:
Multi-backend Support: Works with various vaulting backends including macOS Keychain, Windows Credential Manager, Secret Service (Gnome Keyring/KWallet), Pass, Passage, encrypted files, 1Password Connect, and service accounts.
MFA Integration: Supports multi-factor authentication for added security.
Temporary Credentials Generation: Uses AWS STS services to generate temporary credentials via GetSessionToken or AssumeRole, enhancing security by limiting credential lifespan.
Audience & Benefit:
Ideal for developers and DevOps engineers needing secure access to AWS resources. It complements the AWS CLI, allowing seamless integration into existing workflows while maintaining high security standards.
AWS Vault can be installed using winget, ensuring easy setup in development environments.
README
AWS Vault
> [!NOTE]
> This is a maintained fork of which is an abandoned project.
> Contributions are welcome and preferably please open an issue first.
AWS Vault is a tool to securely store and access AWS credentials in a development environment.
AWS Vault stores IAM credentials in your operating system's secure keystore and then generates temporary credentials from those to expose to your shell and applications. It's designed to be complementary to the AWS CLI tools, and is aware of your profiles and configuration in ~/.aws/config.
The supported vaulting backends can be found in the respective documentation section.
Use the --backend flag or AWS_VAULT_BACKEND environment variable to specify a backend.
Run aws-vault --help to see the backends available in your build and environment.
By default, aws-vault selects the first available backend for the platform:
wincred on Windows, keychain on macOS, and on Linux when Secret Service is available.
On Linux, automatic selection then falls back through , , , , and .
The 1Password and Proton Pass backends are opt-in and are listed after , so choose them explicitly with or .
# Store AWS credentials for the "jonsmith" profile
$ aws-vault add jonsmith
Enter Access Key Id: ABDCDEFDASDASF
Enter Secret Key: ****************************************
Enter MFA Device ARN (If MFA is not enabled, leave this blank): arn:aws:iam::123456789012:mfa/jonsmith
Added credentials to profile "jonsmith" in vault
# Execute a command (using temporary credentials)
$ aws-vault exec jonsmith -- aws s3 ls
bucket_1
bucket_2
# open a browser window and login to the AWS Console
$ aws-vault login jonsmith
# List credentials
$ aws-vault list
Profile Credentials Sessions
======= =========== ========
jonsmith jonsmith -
# Start a subshell with temporary credentials
$ aws-vault exec jonsmith
Starting subshell /bin/zsh, use `exit` to exit the subshell
$ aws s3 ls
bucket_1
bucket_2
How it works
aws-vault uses Amazon's STS service to generate temporary credentials via the GetSessionToken or AssumeRole API calls. These expire in a short period of time, so the risk of leaking credentials is reduced.
AWS Vault then exposes the temporary credentials to the sub-process in one of two ways
Environment variables are written to the sub-process. Notice in the below example how the AWS credentials get written out
Local metadata server is started. This approach has the advantage that anything that uses Amazon's SDKs will automatically refresh credentials as needed, so session times can be as short as possible.
Since v7.3+ aws-vault introduced option to automatically try and do a logout first, before login when executing aws-vault login .
This behavour can be achieved by using --auto-logout or -a flag! Read more in the Managing Sessions docs.
Development
The macOS release builds are code-signed to avoid extra prompts in Keychain. You can verify this with:
codesign --verify --verbose $(which aws-vault)
If you are developing or compiling the aws-vault binary yourself, you can generate a self-signed certificate by accessing Keychain Access > Certificate Assistant > Create Certificate -> Certificate Type: Code Signing. You can then sign your binary with:
go build .
codesign --sign ./aws-vault
🧰 Contributing
Report issues/questions/feature requests on in the issues section.
