Use Dynobase with AWS Vault and Credential Process Profiles

Dynobase supports aws-vault through an AWS profile's credential_process setting. Configure that command to return credential JSON, select the profile in Dynobase and authenticate when prompted. Dynobase can rerun the process when credentials need refreshing; aws-vault remains responsible for obtaining credentials and handling its vault or MFA prompts.

Before you configure the profile

Install aws-vault and configure a working source profile using the project's documentation. The original 99designs repository says it is no longer maintained and points to the ByteNess fork. Use the installation instructions and command syntax for the version you actually have.

This example assumes aws-vault already has a working profile named work. Check the installed command and its location without printing credentials:

aws-vault --version
command -v aws-vault
aws-vault export --help
aws-vault --version
command -v aws-vault
aws-vault export --help

command -v is for a POSIX shell such as zsh or bash. On Windows, locate the executable with PowerShell's Get-Command aws-vault and use its full path.

Keep the source aws-vault profile separate from the profile Dynobase uses. In the example below, work is the existing source and dynobase-work is the wrapper. Do not configure a wrapper that recursively invokes itself.

1. Add a credential-process profile

Add this section to your AWS config file, normally ~/.aws/config:

[profile dynobase-work]
region = us-east-1
credential_process = /opt/homebrew/bin/aws-vault export --format=json work
[profile dynobase-work]
region = us-east-1
credential_process = /opt/homebrew/bin/aws-vault export --format=json work

Replace the executable path, Region and source profile with your actual values. /opt/homebrew/bin/aws-vault is only an example installation path. Quote a path containing spaces, and use a complete executable path rather than relying on a desktop application's shell PATH.

The maintained fork's credential-process documentation uses export --format=json. Older instructions use exec -j or exec --json; check your installed version's help before copying that older syntax. The requirement for Dynobase is a successful process that prints valid credential JSON, without extra banners or logging mixed into stdout.

Do not paste the generated access key, secret or session token into the profile. The process supplies those values when needed. Keep this wrapper free of additional role or MFA configuration unless you deliberately want another authentication step after aws-vault has resolved work.

2. Verify the profile with AWS CLI v2

Test the wrapper rather than only the underlying source profile:

aws sts get-caller-identity --profile dynobase-work --region us-east-1
aws dynamodb list-tables --profile dynobase-work --region us-east-1
aws sts get-caller-identity --profile dynobase-work --region us-east-1
aws dynamodb list-tables --profile dynobase-work --region us-east-1

The first command confirms the account and role without returning secret credentials. The second checks DynamoDB access in the selected Region. If it returns AccessDenied, authentication may have succeeded while the role lacks permission to list tables. Changing credentials or repeating login does not grant that permission.

If the commands fail, resolve the reported aws-vault, profile, network or IAM problem before retrying in Dynobase. Running the JSON-export command directly prints credentials, so do not copy that output into support tickets or screenshots.

3. Select and authenticate in Dynobase

Open Dynobase and choose dynobase-work in the profile selector. If it shows Profile authentication required, choose Authenticate. A credential-process profile can appear before it has an active session; its presence in the selector does not mean authentication has already completed.

If the new profile is missing, open Settings > General and check Included AWS Profiles. Use Reload profiles after changing the config. Under AWS config and credentials files, check that the app reads the file you edited. Custom paths in the app take precedence over its environment and default locations.

You can also create a profile with the app's Credential Process (e.g. aws-vault) profile type. Its Credential Process Command field takes the full command. The app writes this profile's configuration to the AWS config file.

MFA and vault prompts

Do not expect a password prompt on every use. Prompt behavior depends on the vault backend, cached sessions and MFA configuration. A process launched by a desktop app may not have an interactive terminal for a terminal-only prompt.

For macOS MFA, the aws-vault documentation gives an osascript prompt example. If that driver is supported by your installation, the wrapper command can be:

credential_process = /opt/homebrew/bin/aws-vault --prompt=osascript export --format=json work
credential_process = /opt/homebrew/bin/aws-vault --prompt=osascript export --format=json work

Keep the source profile's MFA settings in the aws-vault configuration. Other operating systems need a prompt method supported there; do not copy the macOS flag indiscriminately. If authentication waits without a visible prompt, first verify that the vault can unlock and authenticate outside Dynobase.

Refreshing sessions and troubleshooting

Dynobase uses refreshable credentials for credential-process profiles. When a refresh is needed, it can rerun the configured command and use the returned expiration. A failed command or invalid JSON still requires you to fix the underlying problem; refresh cannot bypass MFA or vault access.

For startup problems, see slow profile loading. Standard IAM Identity Center profiles do not need an aws-vault wrapper: follow the Dynobase SSO guide. The workspace settings guide covers related application settings, and current installers are available from Download.