DEV Community

John Ajera
John Ajera

Posted on

Configuring AWS Vault with the Wincred Backend for Secure Credential Management on Windows

#aws #windows #security #credentials

Configuring AWS Vault with the Wincred Backend for Secure Credential Management on Windows

Managing AWS credentials securely is critical for developers and engineers. AWS Vault is a fantastic tool that enhances credential security by securely storing and accessing AWS credentials. Here's how to set up AWS Vault on a Windows system using the wincred backend.

Note: This guide focuses on configuring AWS Vault with the wincred backend for enhanced security and integration with your Windows system.

Why AWS Vault?

AWS Vault helps:

  • Store credentials securely using Windows Credential Manager via the wincred backend.
  • Avoid hardcoding or saving plain text AWS credentials in configuration files.
  • Use temporary session tokens to interact with AWS services.
  • Integrate seamlessly with Windows security infrastructure.
  • Automatically manage temporary session token lifecycle and renewal.

Step 1: Install AWS CLI

Before installing AWS Vault, ensure the AWS CLI is set up on your system:

For Windows

  1. Download the Windows installer:

  2. Run the installer:

    • Double-click the downloaded AWSCLIV2.msi file

  3. Welcome screen:

    • The AWS Command Line Interface v2 Setup Wizard will open
    • You'll see the welcome screen with the AWS logo
    • Click Next to continue with the installation

  4. End-User License Agreement:

    • You'll see the "End-User License Agreement" screen
    • The license agreement text will be displayed in a scrollable area
    • The "I accept the terms in the License Agreement" checkbox will already be checked
    • Click Next to continue

  5. Custom Setup:

    • You'll see the "Custom Setup" screen
    • "AWS Command Line Interface V2" will be selected by default
    • The default installation location is: C:\Program Files\Amazon\AWSCLIV2\
    • You can click Browse to change the installation location if needed
    • Click Next to continue with the default settings

  6. Ready to install:

    • You'll see the "Ready to install AWS Command Line Interface v2" screen
    • This is the final confirmation before installation begins
    • Click Install to start the installation process

  7. Accept UAC prompt:

    • Windows will show a User Account Control (UAC) dialog
    • Click Yes to allow the installer to make changes to your computer
    • The installer will automatically add AWS CLI to your system PATH

  8. Setup Complete:

    • You'll see the "Completed the AWS Command Line Interface v2 Setup Wizard" screen
    • Click Finish to exit the setup wizard

  9. Verify the installation:

    • Open Command Prompt or PowerShell
    • Run: 
     aws --version
  • The output should display the installed version of AWS CLI

Step 2: Install AWS Vault

Prerequisite: Install Chocolatey

Before installing AWS Vault, you'll need to install Chocolatey (a Windows package manager):

  1. Open PowerShell as Administrator:

    • Right-click on the Start menu
    • Select "Windows PowerShell (Admin)" or "Terminal (Admin)"

  2. Install Chocolatey:

    • Run the following command: 
     Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

  3. Verify Chocolatey installation:

    • Close and reopen PowerShell as Administrator
    • Run: 
     choco --version

  4. Troubleshooting - Remove partial installation (if needed):

    • If you encounter issues during installation, you may have a partial installation
    • Open PowerShell as Administrator
    • Run: 
     # Remove partial install (if any)
 Remove-Item -Recurse -Force C:\ProgramData\chocolatey
  • This clears out whatever was left from the first attempt
  • Then retry the Chocolatey installation from step 2

Install AWS Vault

Now install AWS Vault using Chocolatey:

  1. Install AWS Vault:

    • Open PowerShell as Administrator
    • Run: 
     choco install aws-vault

  2. Verify installation:

    • Close and reopen PowerShell (or Command Prompt)
    • Run: 
     aws-vault --version

Step 3: Configure the wincred Backend

To use the Windows Credential Manager (wincred) backend with AWS Vault, set the AWS_VAULT_BACKEND environment variable:

  1. Set for current session:

    • Open PowerShell
    • Run: 
     $env:AWS_VAULT_BACKEND = "wincred"

  2. Verify the configuration:

    • Run: 
     echo $env:AWS_VAULT_BACKEND
  • You should see wincred as the output

  1. Make it persistent (optional):

    • If you want this to stick across all future sessions, run: 
     [Environment]::SetEnvironmentVariable("AWS_VAULT_BACKEND", "wincred", "User")

  2. Test persistence:

    • Open a new PowerShell window
    • Run: 
     echo $env:AWS_VAULT_BACKEND
  • It should now display wincred automatically

The wincred backend uses Windows Credential Manager to store AWS credentials securely, eliminating the need for additional tools like GPG or pass.

Step 4: Add a Profile

Add your AWS credentials to AWS Vault using the add command:

aws-vault add <profile-name>
Enter fullscreen mode Exit fullscreen mode

This will prompt you to enter your AWS Access Key and Secret Key. The credentials will be securely stored in Windows Credential Manager.

Next, configure the default AWS region for the profile using the AWS CLI:

aws configure set region <your-region> --profile <profile-name>
Enter fullscreen mode Exit fullscreen mode

Replace <your-region> with the desired AWS region (e.g., ap-southeast-2) and <profile-name> with the profile name you added in aws-vault.

Optional Steps

You can also configure additional settings for your profile:

  • Set the MFA serial: 
  aws configure set mfa_serial arn:aws:iam::<account-id>:mfa/<username> --profile <profile-name>
Enter fullscreen mode Exit fullscreen mode
  • Set the role arn: 
  aws configure set role_arn arn:aws:iam::<account-id>:role/<role-name> --profile <profile-name>
Enter fullscreen mode Exit fullscreen mode

Replace <account-id> with your AWS account ID (e.g., 123456789012), <role-name> with the name of the IAM role you want to assume, and <profile-name> with the profile name you added in aws-vault.

  • Set a role session name for better traceability: 
  aws configure set role_session_name <session-name> --profile <profile-name>
Enter fullscreen mode Exit fullscreen mode

Purpose: The role_session_name provides a unique identifier for your session when assuming a role. It appears in AWS CloudTrail logs, making it easier to trace actions performed during the session.

Best Practices:

  • Use a descriptive name that reflects the purpose of the session, such as dev-session or test-session.
  • Ensure session names are unique to avoid confusion when tracking activities in logs.

Step 5: Test Your Setup

Test the configuration by running an AWS CLI command:

aws-vault exec <profile-name> -- aws sts get-caller-identity
Enter fullscreen mode Exit fullscreen mode

This should return details of your AWS account, confirming that AWS Vault is correctly configured.

Troubleshooting: Invalid Security Token Error

If you encounter the error InvalidClientTokenId: The security token included in the request is invalid, follow these steps:

  1. Check your profile credentials: 
   aws-vault list
Enter fullscreen mode Exit fullscreen mode
  1. Remove and re-add the profile: 
   aws-vault remove <profile-name>
   aws-vault add <profile-name>
Enter fullscreen mode Exit fullscreen mode

  1. Verify your AWS credentials:

    • Ensure your AWS Access Key ID and Secret Access Key are correct
    • Check that your AWS account is active and not suspended
    • Verify you have the necessary permissions

  2. Test with a simple command first:

   aws-vault exec <profile-name> -- aws sts get-caller-identity
Enter fullscreen mode Exit fullscreen mode

If the issue persists, the credentials themselves may be invalid or expired.

Conclusion

AWS Vault is an excellent tool for improving the security of AWS credential management. By storing credentials securely using the wincred backend, you can enhance security and integration with your Windows operating system.

The wincred backend provides seamless integration with Windows Credential Manager, eliminating the need for additional tools like GPG or pass while maintaining the same level of security.

If you attempt this setup, please share your feedback or tips for others exploring this configuration. 🚀

Top comments (0)