Highlights
Parallel-safe mode (opt-in)
A new --parallel-safe flag (or AWS_VAULT_PARALLEL_SAFE=true) makes it safe to run many aws-vault processes at once, such as hundreds of credential_process calls from Terraform. It adds cross-process locks so that:
- only one process per SSO start URL refreshes the token or opens a browser sign-in, while the others wait for the cached token
- only one process at a time writes a given cached session
- keyring access is serialized, with one lock per store
- SSO
GetRoleCredentialsrate limits (HTTP 429) are retried with jittered backoff, honouringRetry-After
It's off by default, and without it nothing changes. Every process running at the same time needs it, so setting the environment variable is the easiest way. Lock files live in aws-vault/locks under your user cache directory. See Parallel-safe mode.
Thanks to @timvisher-dd, who wrote the original in #337, and to @posquit0 for rebasing it in #476.
Touch ID only when the keychain is locked (macOS)
With --biometrics, every aws-vault process asked for Touch ID, including every credential_process call. keyring v1.14.0 checks whether the keychain is locked and only prompts then, so how often you see it now follows your keychain's lock settings. See Touch ID. Fixes #421.
Behaviour change
aws-vault exec --jsonwith--server,--ecs-serveror--ec2-servernow fails with an error (exit code 1). Before, it printed credentials, ignored the server flag and exited 0. (#492)
What's Changed
Exciting New Features 🎉
- feat: bump keyring to v1.14.0 so Touch ID only prompts when locked by @mbevc1 in #493
- feat: allow aws-vault to safely be run in parallel (rebase of #337 onto main) by @posquit0 in #476
Bug fixes 🐛
- fix(exec): validate flags on the --json path too by @mbevc1 in #492
- fix(sso): tighten the --parallel-safe token cache and 429 retry by @mbevc1 in #494
- fix(lock): open keyrings under the keyring lock by @mbevc1 in #495
- fix(lock): key keyring locks by the store, not its spelling by @mbevc1 in #496
Dependencies 👒
- chore(deps): Bump github.com/byteness/keyring from 1.13.2 to 1.13.3 in the go-dependencies group across 1 directory by @dependabot[bot] in #490
New Contributors
Full Changelog: v7.16.3...v7.17.0