How to use the command 'aws-vault' (with examples)
AWS Vault is a tool designed to securely store and manage AWS credentials in development environments. By using AWS Vault, developers can prevent credential leakage and ensure that access keys are handled safely. It operates by encrypting credentials and allowing users to execute AWS commands without exposing the credentials in the shell environment or the command history. More information about aws-vault is available on its GitHub page .
Use case 1: Add credentials to the secure keystore
Code:
aws-vault add profile
Motivation: Adding credentials to the secure keystore is an essential first step when setting up AWS Vault. This operation initializes the storage of your AWS credentials in a secure manner, encrypting them to prevent unauthorized access. It’s crucial for developers managing multiple AWS environments who need a streamlined, yet secure way to access different account credentials without manually switching or exposing these sensitive details.
Explanation:
aws-vault: This is the base command to run the aws-vault tool.add: This subcommand is used for adding new AWS credentials into the vault.profile: This argument specifies the name of the AWS CLI profile that the credentials will belong to. This corresponds to a specific set of AWS IAM credentials you want to store securely.
Example output:
Enter Access Key ID: <user-input>
Enter Secret Access Key: <user-input>
Added credentials to profile "profile" in vault
Use case 2: Execute a command with AWS credentials in the environment
Code:
aws-vault exec profile -- aws s3 ls
Motivation: Sometimes, it’s necessary to execute AWS CLI commands that interact directly with AWS services, such as listing S3 buckets. By using AWS Vault to handle credentials securely, developers can execute these commands without exposing sensitive data in their shell’s environment. This use case is perfect for running scripts or commands that require temporary access to AWS resources.
Explanation:
exec: This subcommand allows the execution of a command with the specified AWS profile, injecting temporary credentials into the environment for the command to use.profile: The AWS CLI profile for which to execute the command with credentials.--: This separator indicates that all following arguments should be passed to the command being executed, instead of being parsed by aws-vault.aws s3 ls: The AWS CLI command to list all S3 buckets accessible with the credentials from the specified profile.
Example output:
2023-08-01 12:41:28 example-bucket-1
2023-08-05 08:12:51 example-bucket-2
Use case 3: Open a browser window and login to the AWS Console
Code:
aws-vault login profile
Motivation: Developers often need to access the AWS Management Console to manage resources graphically or configure services that aren’t easily manipulated via the CLI. This command uses aws-vault to securely authenticate and open a browser session directly into the AWS Console without entering credentials manually, thus maintaining high-security standards.
Explanation:
login: This subcommand is used to authenticate the user and launch a web browser with a session to the AWS Management Console.profile: Specifies the AWS CLI profile whose credentials should be used to log into the AWS Console.
Example output:
Login successful, opening browser...
Your default web browser will open displaying the AWS Management Console.
Use case 4: List profiles, along with their credentials and sessions
Code:
aws-vault list
Motivation: Over time, as you manage multiple AWS services and credentials, it becomes critical to maintain an overview of all profiles stored in your vault. This command provides an easy way to audit what credentials are available, which are currently active, and if there are any active sessions that need review or termination.
Explanation:
list: This command lists all the profiles currently stored in aws-vault along with the status of their credentials and any active sessions.
Example output:
Profile Credentials Sessions
--------- ----------- ---------
profile1 Store 1 Session 1
profile2 Store 2 Session 1, Session 2
Use case 5: Rotate AWS credentials
Code:
aws-vault rotate profile
Motivation: Rotating credentials regularly is a best practice for maintaining security in cloud environments. This command simplifies the process of generating and storing new AWS access keys, replacing old ones, and minimizing exposure risk. It is particularly beneficial in environments with strict security policies requiring frequent key rotations.
Explanation:
rotate: This subcommand rotates the IAM user’s access keys for the designated profile, creating a new set while deactivating the previous ones.profile: Specifies which AWS CLI profile’s keys should be rotated.
Example output:
Rotating credentials for profile...
Old credentials deactivated and new credentials stored successfully.
Use case 6: Remove credentials from the secure keystore
Code:
aws-vault remove profile
Motivation: As you update your AWS environment or decommission projects, it becomes necessary to cleanly remove unused credentials from your vault. This reduces clutter and potential security vulnerabilities for unused access keys. This command ensures that credentials no longer required for a profile are securely deleted from the vault.
Explanation:
remove: This subcommand deletes the specified profile’s credentials from the aws-vault keystore entirely.profile: Defines which AWS CLI profile’s credentials need to be purged from the secure store.
Example output:
Credentials for profile "profile" have been removed from the vault.
Conclusion:
AWS Vault is an essential tool for developers and administrators aiming to bolster their security practices when interacting with AWS environments. It provides a mechanism to manage and securely store AWS credentials while facilitating safe execution of AWS tasks without compromising on operational efficiency. Through its various functionalities, AWS Vault supports best practices in credential management, ensuring risk mitigation and operational integrity.
