99designs/aws-vault

AWS Vault is a command-line tool that helps developers work with Amazon Web Services more safely on their own computers. The core problem it addresses is that long-lived AWS access keys stored in a plain text file (the default approach) are easy to accidentally leak through logs, environment dumps, or copied config files. AWS Vault stores those keys in your operating system's built-in secure keystore instead, and then generates short-lived temporary credentials each time you actually need them. Note: the README states the project has been abandoned, and points to an active fork maintained by a different team. The way it works in practice is straightforward. You add a named AWS profile to the vault once, providing your access key ID and secret. After that, when you want to run any AWS-related command, you prefix it with aws-vault exec profilename -- and the tool fetches temporary credentials from Amazon's security service, injects them as environment variables for that single command, and then they expire on their own. The temporary credentials typically last a short period, so even if they were captured they would soon be useless. The tool can also open your browser directly to the AWS web console, logged into a specific account or role, using the login command. This avoids having to manually type credentials into a browser form. For teams that use multiple AWS accounts or permission roles, the tool reads your existing AWS configuration file and understands how to chain through profiles. You can set up a profile that starts with your base credentials and then assumes a role in a different account. Multi-factor authentication is supported too: if your AWS setup requires a one-time code from an authenticator app before assuming a role, the tool will prompt for it at the right moment. The secure keystore backends it supports include macOS Keychain, Windows Credential Manager, Gnome Keyring and KWallet on Linux, the Pass password manager, and an encrypted file option. It is available through most major package managers on macOS, Windows, and Linux, including Homebrew, Chocolatey, Scoop, and several Linux package systems.