aws-vault

AWS Vault is a command-line tool designed to securely store and access AWS credentials in development environments. It stores long-term IAM credentials in the operating system's secure keystore (such as macOS Keychain, Windows Credential Manager, or Linux Secret Service) and then generates short-lived temporary credentials via AWS STS (GetSessionToken or AssumeRole) to expose to your shell and applications. Key features include: - Multiple vaulting backends: macOS Keychain, Windows Credential Manager, Secret Service (Gnome Keyring, KWallet), Pass, and encrypted files - Support for AWS profiles and configuration in ~/.aws/config - Role assumption with MFA support - Two credential exposure modes: environment variables or a local metadata server (for automatic SDK credential refresh) - Subshell execution with temporary credentials - Browser login to AWS Console - Credential listing and management The tool is complementary to the AWS CLI and is designed to reduce the risk of credential leaks by using temporary credentials that expire in a short period. It supports various installation methods including Homebrew, Chocolatey, Scoop, Nix, and more. Note: The original project has been abandoned and is no longer receiving updates. An active fork is available at https://github.com/ByteNess/aws-vault.