v5.1.2

Fixed

• Fixed a regression to --no-session, it now again correctly disables use of GetSessionToken #488 #493 #498

v5.1.1

Fixed

• Using the exec syscall causes the credential server to disappear, so now when using --server we create a child process instead #490

v5.1.0

Fixed

• Fixed role chaining #471 (#481)
• Fixed loading config from default section 955600c

Added

• rotate: Added the --no-session flag to use the master credentials instead of using a temporary session #478 (#481)
• Config environment var AWS_CHAINED_SESSION_TOKEN_TTL to specify the TTL for chained sessions (#481)
• exec: sets an environment variable AWS_SESSION_EXPIRATION #473
• release binaries for linux amd64 #487

v5.0.1

Fixed

• Always output the default header when saving ini file, fixes #475 (#476)

v5.0.0

Refactoring on the codebase took place for this release, see the full changeset here. Please report any bugs

Fixed

• aws-vault exec: Signals to processes now propagate correctly #454
• Case is ignored when parsing config #461
• non-profile sections are ignored when parsing config #293

Added

• The AWS_ROLE_ARN, AWS_ROLE_SESSION_NAME and AWS_MFA_SERIAL environment variables can be used to specify config for the exec, login and rotate commands #443 6c94f99
• A new config variable parent_profile allows a profile to import all of the config and credentials from the specified parent profile, and should be used in conjunction with source_profile. Note that this config variable is not recognised or compatible with aws-cli or SDK #450
• Support for duration_seconds in the .aws/config file 17062f1
• --duration flag on the exec and login command to specify the duration of the session #464

Removed

• --mfa-token flag from the rotate command #460
• --mfa-serial-override flag from the exec command (use AWS_MFA_SERIAL instead) 6c94f99
• --session-ttl, --assume-role-ttl flags from the exec and login command (use --duration instead) #464
• --federation-token-ttl flag from the login command (use --duration instead) #464

Changed

• [BC break] The mfa_serial config is no longer imported from the source_profile. This was behaviour introduced in v4.6.0, however it had unintended backwards-incompatible side effects on existing configs. source_profile now imports credentials only, the same way that the aws cli does. If you relied on the previous mfa_serial importing behaviour, use parent_profile (along with source_profile) #445
• [BC break] The aws-vault exec short flag for --mfa-token was changed from -m to -t, to make it consistent with aws-vault login #464
• aws-vault exec now uses the exec syscall rather than creating a child process #454
• Changed the default durations #464
  • GetSessionToken: 1h (previously 4h)
  • AssumeRole: 1h (previously 15m)
  • GetFederationToken: 1h (previously 12h)
  • Cached MFA GetSessionToken for AssumeRole: 8h (previously 4h)
• Changed API for package github.com/99designs/aws-vault/vault. Note this package exists only to support the CLI and has no guarantees for backwards compatibility. It is public only for the convenience of those already using it

v4.7.1

Fixed

• session cache when using a MFA device #440

v4.7.0

Fixed

• Make password prompts go to stderr #417
• several session-based bugfixes resolved upstream #434
• Report errors via stderr #433
• Build errors on macOS Catalina #427
• Handle forward slash in pass backend #437

Added

• fish shell completion #422

Changed

• macOS Catalina now requires all software to be notorized, so use a signed and notorized dmg disk image to distribute macOS releases #435 8ae71d8
• use Github Actions for CI instead of Travis #436 41610ce

v4.6.4

Fixed

• Compatibility with the latest kwallet 99designs/keyring#51

v4.6.3

Fixed

• secret service issues caused by an old dbus dependency being used in the previous release

v4.6.2

Fixed

• FIxes an issue where aws-vault forgets credentials #391 (full changelog of keyring changes)