4 ms·

This is the best tool I've found so far to manage profiles securely and switching roles between the ~35 accounts im working with right now.

cjcampbell 9y ago
I'm about to evaluate it for my needs. Do you run into any issues with the temporary tokens expiring, e.g., with developers working locally on a web app over a period of a couple hours?
- willejs 9y ago
  Not really. Its quite straight forward and really just makes it easier to store your creds (on any platform) securely, and enables you to switch roles via profiles in your ~/.aws/config. One thing I would point out is that by default it will timeout the session in 4h and the role in 15m. This means that every 15m you will need to exit your bash shell that aws-vault exec created, or replace the env vars you generated. Set the two env vars for session and role ttl to your desired values in your bash profile to avoid setting them on the cli on every invocation. You just want to look at this file, as the env vars are not documented. https://github.com/99designs/aws-vault/blob/4acbb48b48b905553024331408f890f7c18dd517/cli/exec.go#L43 https://github.com/99designs/aws-vault/blob/4acbb48b48b90555...
  - cjcampbell 9y ago
    Appreciate the link. Until now, I've used aws-vault with the `exec` command to run CLI tools with a quick return, so the role TTL isn't much of an issue. I'd like to employ the tool to support local development on a containerized web application. The assume role TTL may prove to be the real issue, so I need to weight the tradeoff of allowing a longer life on the STS keys. I suppose I could set up a profile without a role and override the AWS_PROFILE environment variable within docker-compose. And I know that aws-vault also supports the virtual meta-data service. Either way, the benefit of something like aws-vault extends beyond security. We've discovered numerous inconsistencies with the profile-based credential handlers in the Java API (https://github.com/aws/aws-sdk-java/issues/803 https://github.com/aws/aws-sdk-java/issues/803) which beg for a simpler solution in terms of supporting developers.

cjcampbell 9y ago

I'm about to evaluate it for my needs. Do you run into any issues with the temporary tokens expiring, e.g., with developers working locally on a web app over a period of a couple hours?

willejs 9y ago
Not really. Its quite straight forward and really just makes it easier to store your creds (on any platform) securely, and enables you to switch roles via profiles in your ~/.aws/config. One thing I would point out is that by default it will timeout the session in 4h and the role in 15m. This means that every 15m you will need to exit your bash shell that aws-vault exec created, or replace the env vars you generated. Set the two env vars for session and role ttl to your desired values in your bash profile to avoid setting them on the cli on every invocation. You just want to look at this file, as the env vars are not documented. https://github.com/99designs/aws-vault/blob/4acbb48b48b905553024331408f890f7c18dd517/cli/exec.go#L43 https://github.com/99designs/aws-vault/blob/4acbb48b48b90555...
- cjcampbell 9y ago
  Appreciate the link. Until now, I've used aws-vault with the `exec` command to run CLI tools with a quick return, so the role TTL isn't much of an issue. I'd like to employ the tool to support local development on a containerized web application. The assume role TTL may prove to be the real issue, so I need to weight the tradeoff of allowing a longer life on the STS keys. I suppose I could set up a profile without a role and override the AWS_PROFILE environment variable within docker-compose. And I know that aws-vault also supports the virtual meta-data service. Either way, the benefit of something like aws-vault extends beyond security. We've discovered numerous inconsistencies with the profile-based credential handlers in the Java API (https://github.com/aws/aws-sdk-java/issues/803 https://github.com/aws/aws-sdk-java/issues/803) which beg for a simpler solution in terms of supporting developers.