# Install aws-keychain with Homebrew

Uses macOS keychain for storage of AWS credentials. Version 3.0.0 via Homebrew; verified from local package data.

## Install

```sh
sudo av install brew:aws-keychain
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install aws-keychain
```

  Evidence: local Homebrew formula metadata

## Package facts

- **Package key:** brew:aws-keychain
- **Package manager:** Homebrew
- **Version:** 3.0.0
- **Source summary:** Uses macOS keychain for storage of AWS credentials
- **Homepage:** <https://github.com/pda/aws-keychain>
- **Repository:** <https://github.com/pda/aws-keychain>
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- aws-keychain (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 3.0.0
## Project history and usage

aws-keychain is a macOS shell CLI for storing AWS IAM access keys in the macOS Keychain and checking one selected key out into `~/.aws/credentials` or into a command environment. Its README explicitly says it is no longer maintained and recommends aws-vault instead.

### Project history

The upstream README identifies the project as a 2014-2015 Paul Annesley MIT-licensed tool. It was written for the Mac OS X Keychain era of local AWS access-key management, before newer credential-process, SSO, and vault-style workflows became the dominant recommendation.

### Adoption history

GitHub lists v3.0.0 as the latest release dated September 22, 2015 and describes the repository as succeeded by aws-vault. Homebrew analytics showed only 8 installs in 30 days, 10 in 90 days, and 56 in 365 days at the time of this batch, consistent with a historical package kept around for existing users.

### How it is used

The command supports `add`, `ls`, `exec`, and `rm` operations for named IAM access keys in Keychain. The README warns about shell history when adding keys, supports interactive secret entry, and shows `aws-keychain exec personal aws s3 ls` as the intended safe command-running workflow.

### Why package nerds care

aws-keychain is a compact example of the local-secret-storage lineage that led to better-known tools such as aws-vault. It matters less as a current recommendation and more as a package archaeology marker for how macOS AWS users avoided plaintext credentials before first-class AWS SSO workflows.

### Timeline

- 2014-2015: README copyright period for aws-keychain.
- 2015: GitHub lists v3.0.0 as the latest release, with separate keychain file behavior.
- 2026: Homebrew formula metadata still tracks the v3.0.0 source archive.

### Related projects

- aws-vault: the successor recommended by the aws-keychain README.

### Sources

- <https://formulae.brew.sh/api/formula/aws-keychain.json>
- <https://github.com/pda/aws-keychain>


## Security Notes

narrow executable package without higher-risk signals.

- **Geiger risk:** green / low
- narrow executable package without higher-risk signals


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Credential files

- macOS: ~/.aws/credentials

## Combined YAML source

View the package source record on GitHub. [combined/aws-keychain.yml](https://github.com/mxcl/pkgdb/blob/main/combined/aws-keychain.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- cross-ecosystem install command graph