aws-vault VS aws-cli

Undying fondness for aws-vault to securely cache my session credentials.

you might want to check https://github.com/99designs/keyring and https://github.com/99designs/aws-vault

You install aws-vault (https://github.com/99designs/aws-vault), configure it according to the README and make sure you have an SSO entry that is compatible, i.e.:

I use a aws-vault to switch thought all profiles on all aws account. It support SSO with 2FA.

Nice! Do I understand this correctly?

You use aws-vault(https://github.com/99designs/aws-vault) and configure it with IAM and MFA with YubiKeys. You configure e.g. the profile jonsmith.

When you run

aws-vault exec jonsmith -- aws s3 ls

it will ask you, e.g. every hour to confirm with YubiKeys and cache the key for one hour. After that the temporary keys expire. Can you also store keys different from AWS?

Don't know about kube, but awscli and a few others decouple the idea of getting credentials and doing the actions. You can use the password every time, but a better way is to either use the preconfigured profile or some wrapper which does use the keychain. For example https://github.com/99designs/aws-vault/ supports one-off commands and shell sessions with pre-populated tokens.

It sounds like you have AWS SSO enabled and need a way to run scripts manually in the terminal. Take a look at the aws-vault project that makes it easy working with multiple AWS accounts.

A tool called aws-vault can fix the "insecure" part.

Take a look at aws-vault, which has support for SSO and running in a docker container.

I read the docs on: https://github.com/99designs/aws-vault

The AWS CLI is a must-have tool if your team relies on Amazon Web Services. It lets you effortlessly interact with AWS services, orchestrate resource management, and automate tasks from the comfort of your terminal. Once you get used to the tool, you'll notice how convenient and quick it is to fit into your processes – especially compared to going through AWS's web-based user interface.

Just for your consideration, the network effect is very real with package managers, too:

https://search.nixos.org/packages?channel=23.05&show=awscli2 is 2.11.27 (even on the "unstable" channel), versus https://formulae.brew.sh/formula/awscli#default that is 2.12.1, which correctly is the most current (https://github.com/aws/aws-cli/tags)

s3fs allows Linux, macOS, and FreeBSD to mount an S3 bucket via FUSE(Filesystem in Userspace). s3fs makes you operate files and directories in S3 bucket like a local file system. s3fs preserves the native object format for files, allowing use of other tools like AWS CLI.

AFAIK it's still a Python package: https://github.com/aws/aws-cli/tree/2.11.6

Check CLI version, it looks like the earliest version that had DEEP_ARCHIVE support was 1.16.133 (https://github.com/aws/aws-cli/commit/55efab102f774ef17bf51ad32e939e4e03a5ff8a)

And this is the init_localstack.sh file content, a unique thing about localstack its that you can move all strings like an aws-cli tool, also the container deletes all the content and config once the container stops, so the script file must create all the resources that you need from Localstack

It can? I created a pull request for this that hasn't been merged yet: https://github.com/aws/aws-cli/pull/6365