Credential Process

What is Credential Process?

Credential Process is a configuration option (in the AWS config file) that instruct the AWS CLI and SDKs to use an external command to generate valid credentials in a specific format.

It is a way to generate AWS compatible credentials on the fly, only when requested by tools that respect the AWS credential chain.

Credential Process is perfect if you have a way to generate or look up credentials that isn't directly supported by the AWS CLI or third-party tools; for example, you can configure the AWS CLI to use it by configuring the credential_process setting in the config file.

The difference between Credential Process and Standard Credential file is that credentials in the "credential file" are written in plain text and so, they are potentially unsecure, even if temporary. Credential Process instead, generates credentials that are consumed only when they are effectively needed.

No credential is written in any file. They are printed on the stdout and consumed upon request.

How Credential Process works?

Credential Process asks an external process to generate an AWS compatible temporary credential set in this format:

{
  "Version": 1,
  "AccessKeyId": "an AWS access key",
  "SecretAccessKey": "your AWS secret access key",
  "SessionToken": "the AWS session token for temporary credentials", 
  "Expiration": "ISO8601 timestamp when the credentials expire"
}  

The Expiration field allows the generated credentials to be cached and reused until they are no more valid (by default the value is 3600s=1h).

Advantages

• Ensures that no credential set is written on your machine in neither the ~/.aws/credentials or ~/.aws/config files.
• Ensures your long-running tasks always have valid credentials during their lifecycle.
• Is compatible with named-profiles.
• Is a way to make third-party tool compatible with AWS SSO and SAML Federated IAM Principals even if they don't support them natively.
• As stated by this article by Ben Kehoe, Credential Process is a good way to avoid cluttering the credential file with temporary credentials.

How Leapp works with Credential Process

1) Open your Leapp desktop app and go to the settings panel ().

2) In the general section change the AWS Credential Generation from "credential-file-method" to "credential-process-method".

3) An informative panel will show up telling that you need the CLI installed (see below), click on "I acknowledge it"

4) Now, everytime you click on start () an entry will be created in the ~/.aws/config file with the following format:

[profile PROFILE_NAME]
credential_process=leapp session generate SESSION_ID
region=REGION

5) You can start more than one session, depending on how many named-profile you've created; for every session started with a unique named-profile, a new entry will be created in the config file.