AWS Session Manager for macOS

AWS roles, one click from the menu bar.

Assume an IAM role with or without MFA, see when the source and role sessions expire, and let the active role renew five minutes before it runs out. The temporary credentials land in your own AWS files.

How it works Setup guide

Version 1.2 in development · not yet on the App Store

Illustration of the app's menu panel · labels from the app, sample data

01 · Sessions

Two sessions, two clocks.

A temporary source session comes from your IAM user's access keys. Roles are assumed from it. CloudLatch shows both expiry times, so you know which one needs attention.

Source sessionGetSessionToken · up to 12 h

Source MFA valid until 9:12 PM

Role sessionAssumeRole · renewed

dev

source session role session renewal window, five minutes before expiry

Renew before expiry

The active role renews five minutes before it expires, as long as the source session is still valid.

With MFA

When the source session ends, the panel asks for a fresh MFA code. CloudLatch requests a 12-hour source session; AWS decides the actual expiry.

Without MFA

An account set up for access keys without MFA gets a new source session automatically, if your AWS policies allow it.

02 · Setup

From access keys to your next task.

Authentication runs in the app through the AWS SDK for Swift. No AWS CLI installation is required.

Choose your directory
Open Settings... and grant access to your AWS configuration folder. The folder picker can show hidden folders.
Describe the source
Enter the IAM user's source profile, pick access keys with or without MFA, and paste roles as alias=roleArn, one per line.
Refresh a role
Choose a profile and select Refresh dev.... Enter an MFA code if asked, and the credentials are written for your tools.

~/.aws/credentialssample data

[work-source] untouchedaws_access_key_id = AKIA…EXAMPLEaws_secret_access_key = •••••••• [dev] writtenaws_access_key_id = ASIA…EXAMPLEaws_session_token = •••••••• [default] writtenaws_access_key_id = ASIA…EXAMPLEaws_session_token = •••••••• [personal] preservedaws_access_key_id = AKIA…EXAMPLE

03 · Your files

The selected role profile and default get the new temporary credentials. Tools that use default pick them up right away.
Your source profile stays in your AWS files. Long-lived access keys are never copied into the Keychain.
Every other profile and unrelated key is preserved. Ambiguous or invalid files are rejected rather than overwritten.

04 · Accounts and authentication

Several AWS setups, kept apart.

Save separate accounts for work, clients or a personal sandbox, and choose per account whether it signs in with MFA.

since 1.1

Saved accounts

Each account keeps its own source configuration, role list, AWS directory and Keychain source session. Switch from Settings or the Account menu in the panel.

Only the selected account renews. Switching alone never rewrites your AWS files; the next Refresh does.

since 1.2

MFA, or not

Choose Access keys with MFA or Access keys without MFA for every account. Existing setups keep requiring MFA.

Without MFA, Refresh runs without a code prompt. Your AWS policies still decide whether that access is allowed.

05 · Boundaries

Explicit access. Visible limits.

CloudLatch talks to AWS and nothing else. There is no CloudLatch account, server, analytics or advertising.

One folder at a time

The app works inside the macOS App Sandbox and only accesses the AWS directory you choose for each account.

Keychain for sessions

Temporary source sessions and the MFA device serial are kept in the macOS Keychain, separately for each account.

Quiet diagnostics

Local logs record that a refresh started or failed, without profile names or raw AWS error payloads.

Current scope: macOS 14 or later and IAM user access keys, with or without MFA. IAM Identity Center / SSO, credential_process, role-based source profiles and temporary source credentials are not currently supported. Read about data handling.

In preparation for the App Store.

CloudLatch is under development and not yet publicly available. A download link will be added when the app is available.

See the changelog for what each version adds. Unreleased entries are not downloads.

Read the setup guide Report or ask

System macOS 14 or later
Source IAM user access keys
MFA optional, per account
AWS CLI not required
SSO not supported