CloudLatch app icon CloudLatch
Support

Support and setup.

Configure an IAM user source, choose whether it signs in with MFA, and work with temporary role credentials.

On this page
  1. Before you begin
  2. Set up CloudLatch
  3. Saved accounts
  4. Troubleshooting
  5. Remove local data
  6. Bugs, incidents and questions
  7. Security reports

Development-stage guidance. CloudLatch is being prepared for distribution. These instructions describe the current implementation (version 1.2); no public download is available yet.

Before you begin

  • A Mac running macOS 14 or later.
  • An AWS configuration directory containing a named IAM user profile with access keys.
  • If you sign in with MFA: an MFA device for that IAM user. Without MFA: AWS policies that allow obtaining a session and assuming the roles without MFA.
  • Role ARNs and matching AWS permissions and trust policies supplied by your AWS administrator.

AWS CLI installation is not required. IAM Identity Center / SSO, credential_process, role-based source profiles and temporary source credentials are not currently supported.

Set up CloudLatch

  1. Open Settings... from the menu bar and choose your AWS configuration directory. The folder picker can show hidden folders.
  2. Enter the source IAM user profile name. The source profile must differ from default and every output profile.
  3. Choose Access keys with MFA and enter the shared MFA device serial ARN, or choose Access keys without MFA.
  4. Import role entries using one alias=roleArn entry per line. Use the role ARNs provided by your administrator.
  5. Save the configuration. Choose a role with Switch Profile, then use Refresh <alias>.... With MFA, enter a code when the panel asks for one.

What refreshing changes. CloudLatch replaces credentials in the selected role profile and default. Other profiles and unrelated keys are preserved. Any tool using default will therefore use the newly written credentials.

Changing the directory or authentication settings invalidates the cached source session; with MFA, the next refresh needs a fresh code. Existing app configuration can be imported explicitly from Settings.

Saved accounts

Use Add Account… and Rename… in Settings to keep separate setups, for example for work and a personal sandbox. Each account has its own source profile, authentication method, role list, AWS directory and Keychain source session. Your original setup appears as the Default account.

  • Switch accounts in Settings or from the Account menu at the top of the panel. Switching is blocked while a refresh is running.
  • Switching does not rewrite your AWS files and does not revoke existing sessions. The next Refresh activates the account, reusing its own valid source session or asking for MFA.
  • Only the selected account renews. Accounts that share an AWS directory also share its role profiles and default.

Troubleshooting

Why is a new MFA code required?

The source MFA session has expired or the authentication settings changed. Enter a fresh code when prompted. CloudLatch requests a 12-hour source session; actual expiry is determined by AWS.

Why did automatic renewal stop?

Renewal depends on a valid source session, network access, directory access and AWS permissions. The app attempts renewal five minutes before role expiry. Accounts without MFA can also start a new source session on their own; MFA accounts need a code once the source session has expired. Check both expiry times, then refresh the selected role if needed.

I switched accounts, but my tools still use the old credentials.

That is expected. Switching only changes the selected account. Use Refresh <alias>... to write the new account's role credentials.

Why can’t the app access my AWS files?

Choose the directory again in Settings to grant access. Check that the source profile exists and is supported. The app rejects ambiguous or invalid files and source/output profile collisions rather than overwriting them.

AWS denied the request. What should I check?

Ask your AWS administrator to check the source IAM user’s permissions, MFA requirements, role trust policy and requested role. Do not paste credentials or unredacted AWS errors into public reports.

Remove local data

The data removal instructions cover Keychain entries, local app files and temporary credentials written to your shared AWS file. Quit the app first. Uninstalling alone does not revoke AWS sessions or remove every stored copy.

Bugs, incidents and questions

Use the GitHub issue chooser to select a bug, incident, feature request or support question. English and Polish reports are welcome. A GitHub account is required.

Include the app version, macOS version, whether the account uses MFA, expected and actual behavior, and minimal reproduction steps. For incidents, include impact, start time with timezone, current status and any workaround.

Issues and attachments are public. Never include access keys, session tokens, MFA codes, account IDs, ARNs, credential files, private infrastructure details or unredacted screenshots and logs. Use fictional examples.

Security reports

Report suspected vulnerabilities or credential exposure through GitHub private vulnerability reporting. Do not create a public issue with exploit details. Never attach actual credentials, even privately.

If credentials may have been exposed, revoke or rotate them through AWS independently of the report. No fixed support response time or bounty is promised.