AWS Vault is a command-line tool that securely stores and accesses AWS credentials in development environments.
The tool solves the problem of credential exposure in development workflows by storing long-term IAM credentials in your operating system's secure keystore—macOS Keychain, Windows Credential Manager, or Linux secret services—rather than keeping them in plain text. When you need credentials, AWS Vault retrieves the stored credentials and uses Amazon's STS service to generate temporary credentials via GetSessionToken or AssumeRole API calls. These temporary credentials are then exposed to your shell and applications, expiring after a short period to reduce the risk of credential leakage. The tool integrates with your existing AWS CLI configuration in ~/.aws/config and profiles.
AWS Vault suits developers who want to eliminate long-term credentials from their local environment and shell history. It works across macOS, Windows, and Linux, with support for multiple secure backends including Keychain, Credential Manager, Secret Service implementations like Gnome Keyring and KWallet, Pass, and encrypted files. The tool is designed to complement rather than replace AWS CLI tools, making it suitable for teams already using standard AWS credential configuration workflows.
The project is no longer actively maintained and has been abandoned, with the README directing users to an active fork for ongoing updates and contributions.
