wingetCollections
  • Auto
  • Search
  • Awesome Collections
  • Awesome Programs
  • My Favorite Collections
  • My Collections
  • Account / Settings
  • Terms of Service
  • Privacy
  • About

© 2026 winget.ragerworks.com

Loading...
Install AWS Vault using Winget - wingetCollections
  1. Go back
  2. Packages
  3. AWS Vault
AWS Vault logo

AWS Vault ByteNess Solutions

aws aws-vault cli credentials iam keychain mfa temporary-credentials
Use this command to install AWS Vault:
winget install --id=ByteNess.AWSVault -e

AWS Vault is a tool designed to securely store and manage AWS credentials in a development environment. It stores IAM credentials in your operating system's secure keystore and generates temporary credentials for use with shells and applications, ensuring enhanced security by reducing the risk of credential exposure.

Key Features:

  • Multi-backend Support: Works with various vaulting backends including macOS Keychain, Windows Credential Manager, Secret Service (Gnome Keyring/KWallet), Pass, Passage, encrypted files, 1Password Connect, and service accounts.
  • MFA Integration: Supports multi-factor authentication for added security.
  • Temporary Credentials Generation: Uses AWS STS services to generate temporary credentials via GetSessionToken or AssumeRole, enhancing security by limiting credential lifespan.

Audience & Benefit: Ideal for developers and DevOps engineers needing secure access to AWS resources. It complements the AWS CLI, allowing seamless integration into existing workflows while maintaining high security standards.

AWS Vault can be installed using winget, ensuring easy setup in development environments.

README

AWS Vault

Downloads Continuous Integration

> [!NOTE] > This is a maintained fork of https://github.com/99designs/aws-vault which is an abandoned project. > Contributions are welcome and preferably please open an issue first.

AWS Vault is a tool to securely store and access AWS credentials in a development environment.

AWS Vault stores IAM credentials in your operating system's secure keystore and then generates temporary credentials from those to expose to your shell and applications. It's designed to be complementary to the AWS CLI tools, and is aware of your profiles and configuration in ~/.aws/config.

Check out the announcement blog post for more details.

Installing

You can install AWS Vault:

  • by downloading the latest release
  • using Homebrew: brew install aws-vault
  • on Windows with Chocolatey: choco install aws-vault (repo by Gusztáv Varga)
  • on NixOS (currently only available on the unstable channel): nix-env -iA nixos.aws-vault

Documentation

Config, usage, tips and tricks are available in the USAGE.md file.

Vaulting Backends

The supported vaulting backends are:

  • macOS Keychain
  • Windows Credential Manager
  • Secret Service (Gnome Keyring, KWallet)
Versions
7.8.7
Website
github.com
License
Last updated
1/10/2026
Download latest version
  • KWallet
  • Pass
  • Passage
  • Encrypted file
  • 1Password Connect
  • 1Password Service Accounts
  • 1Password Desktop App

    • Use the --backend flag or AWS_VAULT_BACKEND environment variable to specify.

    Quick start

    # Store AWS credentials for the "jonsmith" profile
$ aws-vault add jonsmith
Enter Access Key Id: ABDCDEFDASDASF
Enter Secret Key: ****************************************
Enter MFA Device ARN (If MFA is not enabled, leave this blank): arn:aws:iam::123456789012:mfa/jonsmith
Added credentials to profile "jonsmith" in vault

# Execute a command (using temporary credentials)
$ aws-vault exec jonsmith -- aws s3 ls
bucket_1
bucket_2

# open a browser window and login to the AWS Console
$ aws-vault login jonsmith

# List credentials
$ aws-vault list
Profile                  Credentials              Sessions
=======                  ===========              ========
jonsmith                 jonsmith                 -

# Start a subshell with temporary credentials
$ aws-vault exec jonsmith
Starting subshell /bin/zsh, use `exit` to exit the subshell
$ aws s3 ls
bucket_1
bucket_2

    How it works

    aws-vault uses Amazon's STS service to generate temporary credentials via the GetSessionToken or AssumeRole API calls. These expire in a short period of time, so the risk of leaking credentials is reduced.

    AWS Vault then exposes the temporary credentials to the sub-process in one of two ways

    1. Environment variables are written to the sub-process. Notice in the below example how the AWS credentials get written out 
      $ aws-vault exec jonsmith -- env | grep AWS
AWS_VAULT=jonsmith
AWS_DEFAULT_REGION=us-east-1
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=%%%
AWS_SECRET_ACCESS_KEY=%%%
AWS_SESSION_TOKEN=%%%
AWS_CREDENTIAL_EXPIRATION=2020-04-16T11:16:27Z
    2. Local metadata server is started. This approach has the advantage that anything that uses Amazon's SDKs will automatically refresh credentials as needed, so session times can be as short as possible. 
      $ aws-vault exec --server jonsmith -- env | grep AWS
AWS_VAULT=jonsmith
AWS_DEFAULT_REGION=us-east-1
AWS_REGION=us-east-1
AWS_CONTAINER_CREDENTIALS_FULL_URI=%%%
AWS_CONTAINER_AUTHORIZATION_TOKEN=%%%

    The default is to use environment variables, but you can opt-in to the local instance metadata server with the --server flag on the exec command.

    Roles and MFA

    Best-practice is to create Roles to delegate permissions. For security, you should also require that users provide a one-time key generated from a multi-factor authentication (MFA) device.

    First you'll need to create the users and roles in IAM, as well as setup an MFA device. You can then set up IAM roles to enforce MFA.

    Here's an example configuration using roles and MFA:

    [default]
region = us-east-1

[profile jonsmith]
mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith

[profile foo-readonly]
source_profile = jonsmith
role_arn = arn:aws:iam::22222222222:role/ReadOnly

[profile foo-admin]
source_profile = jonsmith
role_arn = arn:aws:iam::22222222222:role/Administrator
mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith

[profile bar-role1]
source_profile = jonsmith
role_arn = arn:aws:iam::333333333333:role/Role1
mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith

[profile bar-role2]
source_profile = bar-role1
role_arn = arn:aws:iam::333333333333:role/Role2
mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith

    Here's what you can expect from aws-vault

    CommandCredentialsCachedMFA
    aws-vault exec jonsmith --no-sessionLong-term credentialsNoNo
    aws-vault exec jonsmithsession-tokensession-tokenYes
    aws-vault exec foo-readonlyroleNoNo
    aws-vault exec foo-adminsession-token + rolesession-tokenYes
    aws-vault exec foo-admin --duration=2hroleroleYes
    aws-vault exec bar-role2session-token + role + rolesession-tokenYes
    aws-vault exec bar-role2 --no-sessionrole + roleroleYes

    Auto-logout

    Since v7.3+ aws-vault introduced option to automatically try and do a logout first, before login when executing aws-vault login .

    This behavour can be achieved by using --auto-logout or -a flag! Read more in USAGE.md file.

    Development

    The macOS release builds are code-signed to avoid extra prompts in Keychain. You can verify this with:

    $ codesign --verify --verbose $(which aws-vault)

    If you are developing or compiling the aws-vault binary yourself, you can generate a self-signed certificate by accessing Keychain Access > Certificate Assistant > Create Certificate -> Certificate Type: Code Signing. You can then sign your binary with:

    $ go build .
$ codesign --sign  ./aws-vault

    🧰 Contributing

    Report issues/questions/feature requests on in the issues section.

    Full contributing guidelines are covered here.

    Maintainers

    • Marko Bevc
    • Full contributors list

    References and Inspiration

    • https://github.com/pda/aws-keychain
    • https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html
    • https://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPractices.html#create-iam-users
    • https://github.com/makethunder/awsudo
    • https://github.com/AdRoll/hologram
    • https://github.com/realestate-com-au/credulous
    • https://github.com/dump247/aws-mock-metadata
    • https://boto.readthedocs.org/en/latest/boto_config_tut.html