base on A vault for securely storing and accessing AWS credentials in development environments # AWS Vault [](https://github.com/99designs/aws-vault/releases) [](https://github.com/99designs/aws-vault/actions) AWS Vault is a tool to securely store and access AWS credentials in a development environment. AWS Vault stores IAM credentials in your operating system's secure keystore and then generates temporary credentials from those to expose to your shell and applications. It's designed to be complementary to the AWS CLI tools, and is aware of your [profiles and configuration in `~/.aws/config`](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files). Check out the [announcement blog post](https://99designs.com.au/tech-blog/blog/2015/10/26/aws-vault/) for more details. ## Installing You can install AWS Vault: - by downloading the [latest release](https://github.com/99designs/aws-vault/releases/latest) - on macOS with [Homebrew Cask](https://formulae.brew.sh/cask/aws-vault): `brew install --cask aws-vault` - on macOS with [MacPorts](https://ports.macports.org/port/aws-vault/summary): `port install aws-vault` - on Windows with [Chocolatey](https://chocolatey.org/packages/aws-vault): `choco install aws-vault` - on Windows with [Scoop](https://scoop.sh/): `scoop install aws-vault` - on Linux with [Homebrew on Linux](https://formulae.brew.sh/formula/aws-vault): `brew install aws-vault` - on [Arch Linux](https://www.archlinux.org/packages/community/x86_64/aws-vault/): `pacman -S aws-vault` - on [Gentoo Linux](https://github.com/gentoo/guru/tree/master/app-admin/aws-vault): `emerge --ask app-admin/aws-vault` ([enable Guru first](https://wiki.gentoo.org/wiki/Project:GURU/Information_for_End_Users)) - on [FreeBSD](https://www.freshports.org/security/aws-vault/): `pkg install aws-vault` - on [OpenSUSE](https://software.opensuse.org/package/aws-vault): enable devel:languages:go repo then `zypper install aws-vault` - with [Nix](https://search.nixos.org/packages?show=aws-vault&query=aws-vault): `nix-env -i aws-vault` - with [asdf-vm](https://github.com/karancode/asdf-aws-vault): `asdf plugin-add aws-vault https://github.com/karancode/asdf-aws-vault.git && asdf install aws-vault <version>` ## Documentation Config, usage, tips and tricks are available in the [USAGE.md](./USAGE.md) file. ## Vaulting Backends The supported vaulting backends are: * [macOS Keychain](https://support.apple.com/en-au/guide/keychain-access/welcome/mac) * [Windows Credential Manager](https://support.microsoft.com/en-au/help/4026814/windows-accessing-credential-manager) * Secret Service ([Gnome Keyring](https://wiki.gnome.org/Projects/GnomeKeyring), [KWallet](https://kde.org/applications/system/org.kde.kwalletmanager5)) * [KWallet](https://kde.org/applications/system/org.kde.kwalletmanager5) * [Pass](https://www.passwordstore.org/) * Encrypted file Use the `--backend` flag or `AWS_VAULT_BACKEND` environment variable to specify. ## Quick start ```shell # Store AWS credentials for the "jonsmith" profile $ aws-vault add jonsmith Enter Access Key Id: ABDCDEFDASDASF Enter Secret Key: %%% # Execute a command (using temporary credentials) $ aws-vault exec jonsmith -- aws s3 ls bucket_1 bucket_2 # open a browser window and login to the AWS Console $ aws-vault login jonsmith # List credentials $ aws-vault list Profile Credentials Sessions ======= =========== ======== jonsmith jonsmith - # Start a subshell with temporary credentials $ aws-vault exec jonsmith Starting subshell /bin/zsh, use `exit` to exit the subshell $ aws s3 ls bucket_1 bucket_2 ``` ## How it works `aws-vault` uses Amazon's STS service to generate [temporary credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) via the `GetSessionToken` or `AssumeRole` API calls. These expire in a short period of time, so the risk of leaking credentials is reduced. AWS Vault then exposes the temporary credentials to the sub-process in one of two ways 1. **Environment variables** are written to the sub-process. Notice in the below example how the AWS credentials get written out ```shell $ aws-vault exec jonsmith -- env | grep AWS AWS_VAULT=jonsmith AWS_DEFAULT_REGION=us-east-1 AWS_REGION=us-east-1 AWS_ACCESS_KEY_ID=%%% AWS_SECRET_ACCESS_KEY=%%% AWS_SESSION_TOKEN=%%% AWS_CREDENTIAL_EXPIRATION=2020-04-16T11:16:27Z ``` 2. **Local metadata server** is started. This approach has the advantage that anything that uses Amazon's SDKs will automatically refresh credentials as needed, so session times can be as short as possible. ```shell $ aws-vault exec --server jonsmith -- env | grep AWS AWS_VAULT=jonsmith AWS_DEFAULT_REGION=us-east-1 AWS_REGION=us-east-1 AWS_CONTAINER_CREDENTIALS_FULL_URI=%%% AWS_CONTAINER_AUTHORIZATION_TOKEN=%%% ``` The default is to use environment variables, but you can opt-in to the local instance metadata server with the `--server` flag on the `exec` command. ## Roles and MFA [Best-practice](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#delegate-using-roles) is to [create Roles to delegate permissions](https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html). For security, you should also require that users provide a one-time key generated from a multi-factor authentication (MFA) device. First you'll need to create the users and roles in IAM, as well as [setup an MFA device](https://docs.aws.amazon.com/IAM/latest/UserGuide/GenerateMFAConfigAccount.html). You can then [set up IAM roles to enforce MFA](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-mfa). Here's an example configuration using roles and MFA: ```ini [default] region = us-east-1 [profile jonsmith] mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith [profile foo-readonly] source_profile = jonsmith role_arn = arn:aws:iam::22222222222:role/ReadOnly [profile foo-admin] source_profile = jonsmith role_arn = arn:aws:iam::22222222222:role/Administrator mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith [profile bar-role1] source_profile = jonsmith role_arn = arn:aws:iam::333333333333:role/Role1 mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith [profile bar-role2] source_profile = bar-role1 role_arn = arn:aws:iam::333333333333:role/Role2 mfa_serial = arn:aws:iam::111111111111:mfa/jonsmith ``` Here's what you can expect from aws-vault | Command | Credentials | Cached | MFA | |------------------------------------------|-----------------------------|---------------|-----| | `aws-vault exec jonsmith --no-session` | Long-term credentials | No | No | | `aws-vault exec jonsmith` | session-token | session-token | Yes | | `aws-vault exec foo-readonly` | role | No | No | | `aws-vault exec foo-admin` | session-token + role | session-token | Yes | | `aws-vault exec foo-admin --duration=2h` | role | role | Yes | | `aws-vault exec bar-role2` | session-token + role + role | session-token | Yes | | `aws-vault exec bar-role2 --no-session` | role + role | role | Yes | ## Development The [macOS release builds](https://github.com/99designs/aws-vault/releases) are code-signed to avoid extra prompts in Keychain. You can verify this with: ```shell $ codesign --verify --verbose $(which aws-vault) ``` If you are developing or compiling the aws-vault binary yourself, you can [generate a self-signed certificate](https://support.apple.com/en-au/guide/keychain-access/kyca8916/mac) by accessing Keychain Access > Certificate Assistant > Create Certificate -> Certificate Type: Code Signing. You can then sign your binary with: ```shell $ go build . $ codesign --sign <Name of certificate created above> ./aws-vault ``` ## References and Inspiration * https://github.com/pda/aws-keychain * https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html * https://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPractices.html#create-iam-users * https://github.com/makethunder/awsudo * https://github.com/AdRoll/hologram * https://github.com/realestate-com-au/credulous * https://github.com/dump247/aws-mock-metadata * https://boto.readthedocs.org/en/latest/boto_config_tut.html ", Assign "at most 3 tags" to the expected json: {"id":"11384","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"