AWS credentials

Connections that use AWS IAM or AWS Secrets Manager (see Amazon Aurora and RDS) need AWS credentials. You choose where they come from on the connection’s Security tab.

Credential source

Credential source has three choices:

• Profile (the default): a named profile from your AWS configuration, as the AWS CLI reads it.
• Default chain: the AWS SDK’s default credential chain.
• Access keys: an access key that you enter in DataKlin.

Every source also needs an AWS region. DataKlin fills it in from the profile’s region, or from an Aurora or RDS endpoint’s host name.

Profile

The AWS profile list shows the profiles in your shared AWS config and credentials files (~/.aws/config and ~/.aws/credentials, or the files that AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE name), with each profile’s kind and region. DataKlin never shows key material. If you add a profile while DataKlin is open, click Refresh profiles, or type its name.

DataKlin resolves a profile as the AWS CLI does:

• Access keys in the profile.

• IAM Identity Center (SSO). DataKlin uses the session that the AWS CLI signed in. It can’t sign in for you, so sign in first:

  aws sso login --profile dev-admin

  When the session has expired, DataKlin says so and shows that command for your profile, with a Copy button. Sign in again, then reconnect.

• Assumed role (role_arn with source_profile or credential_source). DataKlin assumes the role and assumes it again when the credentials expire. Profiles that ask for an MFA code (mfa_serial) aren’t supported in this release: use an IAM Identity Center profile instead.

• credential_process. DataKlin runs the profile’s helper program with a time limit and an output size limit, and without DataKlin’s own sensitive environment variables.

The Profile source ignores AWS environment variables such as AWS_PROFILE and AWS_ACCESS_KEY_ID.

Default chain

Default chain finds credentials the way AWS tools do when no profile is named: AWS environment variables, then the default profile (including SSO), then container and instance credentials. It’s the only source that reads environment variables such as AWS_PROFILE and AWS_ACCESS_KEY_ID.

An app started from the macOS Dock or Finder doesn’t get the variables you set in your shell, so on macOS a named profile is usually the better choice.

Access keys

Enter an Access key ID and Secret access key, plus a Session token (optional) for temporary credentials. DataKlin keeps them in your operating system’s secure storage, like a saved password (see Secret storage). Once saved, a key shows “Stored in vault” with Replace and Clear, never its value.

Test the credentials

Test AWS credentials asks AWS who the credentials belong to and shows the account and ARN, for example “Account 123456789012, arn:aws:sts::123456789012:assumed-role/dev-admin/alice”. If it fails, it says why, such as an expired SSO session or a profile that doesn’t exist, and how to fix it.

Saved access keys can’t be tested from the Security tab. Type them again to test them, or click Test connection, which tests the whole connection.

How DataKlin keeps credentials

• DataKlin’s main process resolves the credentials when you connect. The database connector only receives what the connection needs: an IAM database token, or the user name and password from AWS Secrets Manager.
• Resolved credentials are kept in memory until 5 minutes before they expire, and DataKlin never writes them to disk.
• Tokens and keys are removed from logs and error messages.