# Install aws-vault with Homebrew, chocolatey, MacPorts, Nix, pacman, scoop, winget Securely store and access AWS credentials in development environments. Version 7.13.2 via Homebrew; verified 2026-07-30. Also installable with nix: nix profile install nixpkgs#aws-vault. ## Install ```sh sudo av install brew:aws-vault ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install aws-vault ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install aws-vault ``` Evidence: MacPorts ports tree: security/aws-vault/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Nix (92%): ```sh nix profile install nixpkgs#aws-vault ``` Evidence: nixpkgs package indexes: pkgs/by-name/aw/aws-vault/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S aws-vault ``` Evidence: Arch Linux sync databases: aws-vault from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz ### Windows - Chocolatey (92%): ```sh choco install aws-vault ``` Evidence: Chocolatey community package catalog: aws-vault from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','authy-desktop' - Scoop (92%): ```sh scoop install main/aws-vault ``` Evidence: Scoop official bucket manifest trees: bucket/aws-vault.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id 99designs.aws-vault -e ``` Evidence: Windows Package Manager source index: 99designs.aws-vault from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:aws-vault - **Package manager:** Homebrew - **Package manager page:** - **Version:** 7.13.2 - **Source summary:** Securely store and access AWS credentials in development environments - **Homepage:** - **Repository:** - **License:** MIT - **Source archive:** - **Last updated:** 2026-07-30T15:04:00Z - **Generated:** 2026-08-04T22:13:35+00:00 ## Executables - aws-vault (cli) - aws-vault (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-08-04 - Package-manager version: 7.13.2 - Package-manager updated: 2026-07-30 - Local data: ok - Upstream repository: https://github.com/ByteNess/aws-vault - Upstream latest detected: v7.13.2 (current) ## Project history and usage AWS Vault is a long-running AWS credential helper that stores IAM credentials in a secure backend and generates temporary credentials for local development. The Homebrew formula now tracks the maintained ByteNess fork, whose README states that it continues the abandoned 99designs project. ### Project history The original project started at 99designs in 2015 and quickly established the `aws-vault add` plus `aws-vault exec` workflow for keeping long-term AWS keys out of plaintext shell environments. Its documentation made `~/.aws/config` the coordination point while storing secrets in platform facilities such as macOS Keychain, Windows Credential Manager, Secret Service, KWallet, pass, or encrypted files. In May 2025, the ByteNess fork was created as an active continuation. By June 2026 the original 99designs README warned that the old project was abandoned, while the ByteNess README called itself a maintained fork and documented newer backend support such as Windows Hello, keyctl, Passage, and 1Password options. ### Adoption history AWS Vault has broad package-manager reach: the original README listed Homebrew, MacPorts, Chocolatey, Scoop, Arch, Gentoo, FreeBSD, OpenSUSE, Nix, and asdf, while the ByteNess README keeps Homebrew, Chocolatey, and Nix as prominent install paths. Homebrew analytics showed several thousand 30-day formula installs in June 2026. Its adoption is tied to security posture in developer AWS accounts: teams can store persistent IAM keys in a local secure backend, require MFA, and hand commands only short-lived STS credentials. That pattern made it useful for Terraform, SDKs, CI-adjacent local scripts, and desktop apps that need AWS credentials without placing static keys in environment variables. ### How it is used Common usage is `aws-vault add ` followed by `aws-vault exec -- `, `aws-vault login `, or `aws-vault export` through `credential_process`. The usage guide describes executor mode, master-credential-vault mode, MFA session cache mode, and caching of alternative credential sources such as SSO and web identity. The maintained fork also documents backend selection and migration between backends, which matters for users moving between macOS Keychain, Linux desktop secret stores, 1Password, and encrypted-file fallback. ### Why package nerds care AWS Vault matters to package nerds because it is both a security tool and a packaging case study: a mature, heavily packaged CLI moved from an abandoned original upstream to an active fork while retaining the same command name and ecosystem expectations. Homebrew formula metadata now points at ByteNess release tags rather than the older 99designs releases. ### Timeline - 2015-08: Original 99designs/aws-vault repository created. - 2015-09: v1.0.0 GitHub release published by 99designs/aws-vault. - 2023-03: 99designs/aws-vault v7.2.0 published. - 2025-05: ByteNess/aws-vault repository created as the maintained fork. - 2026-06: ByteNess v7.12.4 published; Homebrew formula tracked v7.12.4. ### Related projects - `99designs/aws-vault` is the original upstream and remains the source for the legacy cask. - `aws-sso-cli`, `aws-sso-util`, and `aws2-wrap` cover adjacent IAM Identity Center workflows that became more important after AWS CLI v2. ### Sources - - - - - ## Security Notes No matching local secret-handling manifest was found for aws-vault. Package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ~/.aws/config - Windows: %USERPROFILE%\.aws\config ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** aws-vault - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - aws-vault: normalized package name match | nixpkgs package indexes: pkgs/by-name/aw/aws-vault/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman - aws-vault - 7.13.0-1: normalized package name match | Arch Linux sync databases: aws-vault from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Vault for securely storing and accessing AWS credentials in development environments | https://github.com/ByteNess/aws-vault - MacPorts - aws-vault: normalized package name match | MacPorts ports tree: security/aws-vault/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Chocolatey - aws-vault: normalized package name match | Chocolatey community package catalog: aws-vault from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','authy-desktop' - Scoop - main/aws-vault: normalized package name match | Scoop official bucket manifest trees: bucket/aws-vault.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget - 99designs.aws-vault: normalized package name match | Windows Package Manager source index: 99designs.aws-vault from https://cdn.winget.microsoft.com/cache/source.msix - winget - ByteNess.AWSVault: normalized package name match | Windows Package Manager source index: ByteNess.AWSVault from https://cdn.winget.microsoft.com/cache/source.msix ## Related links - [Cloud CLI packages](https://pkg.so/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Source-control packages](https://pkg.so/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://pkg.so/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [go](https://pkg.so/brew/go/) - Build dependency declared by Homebrew. - [rolesanywhere-credential-helper](https://pkg.so/brew/rolesanywhere-credential-helper/) - Shares pkgdb curated category or tags: aws, cli, credentials, security. - [aws-keychain](https://pkg.so/brew/aws-keychain/) - Shares pkgdb curated category or tags: aws, cli, credentials, security. - [saml2aws](https://pkg.so/brew/saml2aws/) - Shares pkgdb curated category or tags: aws, cli, security, sts. - [okta-aws-cli](https://pkg.so/brew/okta-aws-cli/) - Shares pkgdb curated category or tags: aws, cli, security, sts. - [granted](https://pkg.so/brew/granted/) - Shares pkgdb curated category or tags: aws, cli, credentials, security. - [okta-awscli](https://pkg.so/brew/okta-awscli/) - Shares pkgdb curated category or tags: aws, cli, mfa, security. - [aws-rotate-key](https://pkg.so/brew/aws-rotate-key/) - Shares pkgdb curated category or tags: aws, cli, credentials, security. - [envchain](https://pkg.so/brew/envchain/) - Shares pkgdb curated category or tags: cli, credentials, keychain, security. - [aws-vault-binary](https://pkg.so/cask/aws-vault-binary/) - Executable or command metadata overlaps with this package. Shared terms: aws, aws-vault, cli, credentials, development. ## Combined YAML source View the package source record on GitHub. [combined/aws-vault.yml](https://github.com/mxcl/pkgdb/blob/main/combined/aws-vault.yml) ## Sources - pkg.so package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph