Effortlessly Manage AWS Access: Secure AWS-Vault Guide

Managing access to Amazon Web Services (AWS) can feel like a complex task, especially when juggling multiple accounts or needing different permission levels. How do you ensure your sensitive credentials are secure while still allowing for flexible access? This is where AWS-Vault, an excellent open-source tool, comes into play.

This guide will walk you through setting up and using AWS-Vault on macOS to securely manage your AWS credentials, assume IAM roles, and enhance your overall AWS security posture. While our examples focus on macOS, the core concepts and similar steps apply to Linux and Windows environments.

It’s an awesome GitHub project. I will use macOS in this example, but the same process will work for Unix-based systems such as Linux.

Click here for the Documentation.

What is Amazon Web Services (AWS)?

For those new to the term, Amazon Web Services (AWS) is a comprehensive cloud computing platform offering a vast array of services, from simple storage and computing power to databases, machine learning, and more. With such powerful tools at your fingertips, securing access is paramount.

Why is Secure AWS Access So Important?

Leaked AWS credentials can lead to unauthorized access, data breaches, unexpected costs, and significant damage to your applications and reputation. Traditional methods like storing plaintext access keys in configuration files pose a major security risk. AWS-Vault helps mitigate these risks.

What is AWS-Vault and Why Should You Use It?

AWS-Vault is a utility designed to securely store and access your AWS IAM (Identity and Access Management) credentials. Instead of scattering your secret keys in plaintext files, AWS-Vault stores them in your operating system’s native secure keystore (like macOS Keychain, Windows Credential Manager, or Linux Pass).

Key Benefits of Using AWS-Vault:

• Enhanced Security: Your sensitive IAM access keys are encrypted and stored securely in your OS keychain, not in plaintext configuration files.
• Simplified Role Switching: Easily assume different IAM roles for different tasks or accounts without manually handling temporary credentials.
• MFA Integration: Seamlessly works with Multi-Factor Authentication (MFA) for an added layer of security.
• Temporary Credentials: Generates temporary credentials for AWS Management Console access and CLI (Command Line Interface) sessions, adhering to best security practices.
• Cross-Platform: Supports macOS, Windows, and various Linux distributions.
• Open Source: Developed and maintained by the community (originally by 99designs), ensuring transparency.

Prerequisites

Before we dive in, make sure you have the following:

1. An AWS Account: You’ll need access to an AWS account.
2. An IAM User: It’s best practice to use an IAM user with specific permissions rather than your root account. This user will need programmatic access (an Access Key ID and Secret Access Key).
   • Permissions: The IAM user whose keys will be stored by AWS-Vault should ideally have permissions limited to assuming roles (e.g., sts:AssumeRole) and managing their own MFA device.
3. Homebrew (for macOS users): This guide uses Homebrew, a popular package manager for macOS. If you don’t have it, visit Brew.sh to install it.
4. Basic Terminal Familiarity: You should be comfortable opening and using a terminal application (like Terminal or iTerm2 on macOS).

For Alternative Operating Systems, check out this:

Step 1 – Install AWS-Vault

There are several ways to install AWS-Vault

How do I integrate AWS Vault?

You can install AWS Vault:

• on Windows with Chocolatey: choco install aws-vault
• on Windows with Scoop: scoop install aws-vault
• on Linux with Homebrew on Linux: brew install aws-vault
• on Arch Linux: pacman -S aws-vault
• on FreeBSD: pkg install aws-vault
• with Nix: nix-env -i aws-vault

Install with Brew on MacOS

This example demonstrates how to install AWS-VAULT on Macintosh, and this process will be almost identical on Linux-based distributions. My personal favorite tool for installing packages on macOS is Brew.

Visit Brew.SH to find out more.

Open your terminal session. I will be using iTerm2, and you can find a link to it here.

The Installation Command requires Brew to install if you have not already got Brew installed type:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Now Install vault and the AWS-CLI

brew install aws-vault
brew install awscli

Note – These commands also work on Linux

Step 2 – Create an Access Key in the AWS Console

Vault requires a programmatic access key to your AWS credentials.

Log in to AWS Console

• Go to IAM → Users → your user
• Go to Security Credentials Tab
• Select Create Access Key

What commands would you need to create an AWS secret from Vault?

Step 3 – Create a KeyChain

Return to your macOS terminal and enter the following:

aws-vault add *prod/non-prod*

Note - substitute *prod/non-prod* with whatever you want to call your AWS-Vault KeyChain

Enter the Access Key ID & Secret Key when requested

This information is available in the AWS console > IAM > Users > <Your User ID>

Step 4 – Create / Update your local AWS config

Edit your AWS Config File (typically located at ~/.aws/config)

sudo nano ~/.aws/config

and add the below configuration:

[default] region=my_region output=json
credential_process=aws-vault exec prod -j

[profile myprofile1]
credential_process=aws-vault exec prod -j

[profile myprofile_admin]
source_profile=myprofile1
role_arn=arn:aws:iam::XXXXXXXXXXXXXXXXXXX:role/my-admin-role
mfa_serial=arn:aws:iam::XXXXXXXXXXXXXXXXX:mfa/my_mfa

Note - Substitute role_arn and mfa_serial with you details from the AWS Console

Step 5 – Log into AWS with AWS-Vault

To access AWS using VAULT

Open a terminal session and type

aws-vault login prod

You will be prompted for your local Keystore password, and your MFA code, and then the AWS console will open, and you will automatically assume the role configured in myprofile_admin.

Best Practices for Using AWS-Vault

• Principle of Least Privilege: The IAM user whose keys are stored in AWS-Vault should have minimal direct permissions – ideally, only permissions to assume necessary roles (sts:AssumeRole) and manage its own MFA/credentials.
• Strong Keychain Password: Ensure your operating system user account has a strong, unique password, as this protects your keychain.
• Descriptive Profile Names: Use clear and descriptive names for your AWS-Vault profiles and in your ~/.aws/config file to easily identify them.
• Regularly Audit IAM: Periodically review your IAM users, roles, and policies.
• Keep Tools Updated: Regularly update AWS-Vault and the AWS CLI to their latest versions: Bashbrew upgrade aws-vault brew upgrade awscli
• Consider Session Durations: By default, AWS-Vault sessions are for 1 hour. You can customize this using the --duration flag with aws-vault exec or by configuring role session durations in IAM.

Troubleshooting Common Issues

• “Profile not found”: Double-check that the profile name in your command matches exactly what’s in ~/.aws/config and what you used with aws-vault add.
• MFA Errors: Ensure the mfa_serial in ~/.aws/config is correct and that your MFA device is synced.
• Permission Denied: If you get access denied errors after assuming a role, verify that the IAM role itself has the necessary permissions for the actions you’re trying to perform.

Conclusion

AWS-Vault is an invaluable tool for anyone working with AWS, from beginners to seasoned professionals. By securely storing your IAM credentials and simplifying the process of assuming roles with MFA, it significantly boosts your security posture and makes managing AWS access much more convenient.

By following this guide, you’ve taken a significant step towards more secure and efficient AWS credential management on your macOS system.

Thanks for taking the time to read this article. If you have any questions or feedback, please share them in the comment section below!

Top Q&A for AWS-Vault

What is AWS Vault?

Vault is a Keystore that securely controls access to AWS using existing user roles and multi-factor authentication.

Top tips for using AWS Vault

1. Consider using AWS Vault to store data that you need to keep safe and accessible.

2. AWS Vault is a great way to store data that you need to access quickly.

3. AWS Vault makes it easy to manage your accounts and data.

How do I use AWS Vault?

This procedure will give you a very good start on AWS-Vault. If you want to dig deeper, there is a detailed readme from the creators of AWS-Vault.

How do I install AWS-Vault?

AWS-Vault is a software application that helps organizations securely store sensitive data. To install AWS-Vault, follow these steps:

1. Download the AWS-Vault installer.

2. Start the installer and follow the instructions.

3. After the installation is complete, you can start using AWS-Vault.

How do I use AWS-Vault with MFA?

See Step 4 of this procedure.

Thanks for taking the time to read this article. if you have any questions or feedback, please write in the comment section below.