99designs/aws-vault
Aws Vault
aws-vault is a secure credential manager and command-line wrapper for AWS. It stores long-term identity keys using the native operating system secure keystore to prevent plaintext secrets from residing on disk.
The tool orchestrates the exchange of long-term credentials for short-lived temporary sessions by assuming IAM roles, with support for multi-factor authentication and integration with AWS Identity Center for single sign-on access. It prevents credential exposure by injecting these temporary tokens directly into subprocesses or by simulating local metadata endpoints for software development kits.
The project provides capabilities for managing multiple credential profiles, rotating access keys, and automating sign-ins to the AWS management console. It also supports custom multi-factor authentication command integration to retrieve tokens from external hardware devices or password managers.
Features
- Cloud Credential Management - Provides a secure manager for organizing and switching between multiple AWS credential profiles.
- Credential Security Managers - Encrypts and protects sensitive AWS access credentials using the native operating system secure keystore.
- CLI Wrappers - Injects temporary AWS credentials into sub-processes to prevent long-term keys from residing in environment variables.
- Environment Variable Injection - Injects temporary credentials into the environment of child processes to prevent secrets from persisting in the shell.
- Process Injection Wrappers - Wraps child processes to inject temporary security keys directly into their environment or via a local metadata server.
- SSO Clients - Provides a command-line interface for managing identity access via AWS Identity Center and single sign-on URLs.
- AWS Credential Management - Stores and accesses AWS identity keys securely using the operating system keystore to avoid plaintext secrets on disk.
- Credential Encryption - Encrypts long-term credentials using the operating system native secure keystore or encrypted files.
- Temporary Security Tokens - Executes commands in subprocesses by injecting short-lived security tokens to prevent long-term key exposure.
- Subprocess Injection - Injects short-lived session tokens into commands or subshells to limit the risk of credential exposure.
- SSO Integrations - Manages access to multiple AWS accounts through single sign-on URLs and centralized identity provider roles.
- Keystore Management - Uses the native operating system secure keystore to encrypt and store long-term identity keys.
- AWS Role Assumption - Exchanges long-term credentials for short-lived temporary tokens by assuming specific IAM roles.
- Credential Management Tools - Provides a secure tool for storing and accessing AWS credentials using the operating system native secure keystore.
- Secret Management Systems - Saves long-term access keys into a secure operating system keystore to prevent plaintext storage on disk.
- Single Sign-On Integrations - Integrates with AWS IAM Identity Center to manage credentials via single sign-on URLs and account roles.
- AWS Local Development Environments - Provides local simulation environments and credential injection for AWS software development and testing.
- Console Login Automation - Automatically opens a web browser and signs into the AWS management console using stored credentials.
- MFA Token Retrieval - Provides integration with external tools and hardware devices to retrieve multi-factor authentication tokens.
- MFA Tool Integration - Executes custom command-line tools to retrieve authentication tokens from password managers or hardware devices.
- Metadata Server Simulators - Runs a background server that mimics metadata services to provide dynamic credential refreshing for long-running applications.
- Cloud Console Authentication - Automates the sign-in process for the AWS management console using securely stored credentials.
- Cloud Metadata Simulation - Runs a local HTTP server that simulates cloud metadata endpoints for dynamic credential refreshing.
- Credential Profiles - Provides tools to add, remove, and list identity profiles stored within the operating system secure keystore.
- Web Identity Token Exchange - Obtains temporary credentials using identity tokens provided via files or external identity processes.
- Automated Key Rotations - Implements automatic replacement of old identity keys with new ones to maintain security hygiene.
- Authentication Token Caching - Stores temporary credentials in a secure vault to reuse across profiles and reduce MFA prompts.
- Cloud Security Tooling and Automation - Secure storage utility for cloud credentials.
- Identity and Access Management - Secure storage and access for AWS credentials.
- Secrets Management - Securely stores and accesses AWS credentials locally.
