{"id":881,"date":"2025-11-11T23:17:49","date_gmt":"2025-11-11T15:17:49","guid":{"rendered":"https:\/\/vinta.ws\/code\/?p=881"},"modified":"2026-02-18T01:20:34","modified_gmt":"2026-02-17T17:20:34","slug":"1password-cli-how-not-to-store-plaintext-aws-credentials-on-localhost","status":"publish","type":"post","link":"https:\/\/vinta.ws\/code\/1password-cli-how-not-to-store-plaintext-aws-credentials-on-localhost.html","title":{"rendered":"1Password CLI: How NOT to Store Plaintext AWS Credentials or .env on Localhost"},"content":{"rendered":"

No More ~\/.aws\/credetials<\/code><\/h2>\n

According to AWS security best practices, human users should access AWS services using short-term credentials provided by IAM Identity Center. Long-term credentials ("Access Key ID" and "Secret Access Key") created by IAM users should be avoided, especially since they are often stored in plaintext on disk: ~\/.aws\/credetials<\/code>.<\/p>\n

However, if you somehow have to use AWS access keys but want an extra layer of protection, 1Password CLI can help.<\/p>\n

ref:
\nhttps:\/\/docs.aws.amazon.com\/IAM\/latest\/UserGuide\/best-practices.html<\/a>
\nhttps:\/\/developer.1password.com\/docs\/cli\/get-started<\/a><\/p>\n

First, delete your local plaintext AWS credentials. Don't worry, you could generate new one any time on AWS Management Console.<\/p>\n

rm -rf ~\/.aws\/credetials<\/code><\/pre>\n
Re-create aws-cli configuration file, but DO NOT<\/strong> provide any credentials.<\/p>\n
aws configure\n\nAWS Access Key ID [None]: JUST PRESS ENTER, DO NOT TYPE ANYTHING\nAWS Secret Access Key [None]: JUST PRESS ENTER, DO NOT TYPE ANYTHING\nDefault region name [None]: ap-northeast-1\nDefault output format [None]: json<\/code><\/pre>\n
Edit ~\/.aws\/credentials<\/code>:<\/p>\n
[your-profile-name]\ncredential_process = sh -c \"op item get \"AWS Access Key\" --account=my.1password.com --vault=Private --format=json --fields label=AccessKeyId,label=SecretAccessKey | jq 'map({key: .label, value: .value}) | from_entries + {Version: 1}'\"<\/code><\/pre>\n
The magic is credential_process<\/code> which sourcing AWS credentials from an external process: 1Password CLI's op item get<\/code> command.<\/p>\n
The one-liner script assumes you have an item named AWS Access Key<\/code> in a vault named Private<\/code> in 1Password, and the item has following fields:<\/p>\n