{"id":21354888,"url":"https://github.com/salrashid123/aws-pkcs-process-credential","last_synced_at":"2026-02-19T15:35:53.178Z","repository":{"id":204551358,"uuid":"712124720","full_name":"salrashid123/aws-pkcs-process-credential","owner":"salrashid123","description":"AWS Process Credentials for Hardware Security Module (HSM) with PKCS11","archived":false,"fork":false,"pushed_at":"2025-06-20T16:42:37.000Z","size":97,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-29T18:56:43.754Z","etag":null,"topics":["authentication","aws","aws-authentication","credentials","hsm","pkcs11","tpm2","trusted-platform-module"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/salrashid123.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-10-30T20:54:16.000Z","updated_at":"2025-06-20T16:42:14.000Z","dependencies_parsed_at":null,"dependency_job_id":"bee6b010-0bd4-4515-bd02-d92210854a84","html_url":"https://github.com/salrashid123/aws-pkcs-process-credential","commit_stats":null,"previous_names":["salrashid123/aws-pkcs-process-credential"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/salrashid123/aws-pkcs-process-credential","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Faws-pkcs-process-credential","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Faws-pkcs-process-credential/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Faws-pkcs-process-credential/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Faws-pkcs-process-credential/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/salrashid123","download_url":"https://codeload.github.com/salrashid123/aws-pkcs-process-credential/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/salrashid123%2Faws-pkcs-process-credential/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29620144,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-19T13:04:20.082Z","status":"ssl_error","status_checked_at":"2026-02-19T13:03:33.775Z","response_time":117,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","aws","aws-authentication","credentials","hsm","pkcs11","tpm2","trusted-platform-module"],"created_at":"2024-11-22T04:14:48.828Z","updated_at":"2026-02-19T15:35:53.162Z","avatar_url":"https://github.com/salrashid123.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"### AWS Process Credentials for Hardware Security Module (HSM) with PKCS11\n\nAWS [Process Credential](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html) source where the `AWS_SECRET_ACCESS_KEY` is embedded into an HSM and accessed using `PKCS-11`\n\nUse the binary as a way to use aws cli and any sdk library where after setup, you don't actually need to know the _source_ AWS_SECRET_ACCESS_KEY. \n\nTo use this, you need to save the AWS_SECRET_ACCESS_KEY into an HSM:\n\n1. Directly load `AWS_SECRET_ACCESS_KEY` \n\n   With this, you \"load\" the AWS_SECRET_ACCESS_KEY into a HSM and access the key though a PKCS URI \n\n2. Securely Transfer `AWS_SECRET_ACCESS_KEY` from one host to another\n\n\nThis repo shows how to do `1`\n\nIf you're curious how all this works, see\n\n- [AWS Credentials for Hardware Security Modules and TPM based AWS_SECRET_ACCESS_KEY](https://github.com/salrashid123/aws_hmac)\n- [PKCS 11 Samples in Go using SoftHSM](https://github.com/salrashid123/go_pkcs11)\n\n\u003e\u003e note, this repo is **not** supported by google and is +experimental+\n\nalso see [AWS Process Credentials for Trusted Platform Module (TPM)](https://github.com/salrashid123/aws-tpm-process-credential)\n\n---\n\n### Quickstart (SoftHSM)\n\nHow you load an HMAC key into an HSM isn't covered here but what the following shows is how to demo this using  [SoftHSM](https://github.com/opendnssec/SoftHSMv2)\n\nTo use this,  [install go](https://go.dev/doc/install), `pkcs11-tool`, [SoftHSM](https://github.com/opendnssec/SoftHSMv2) and then run the following which load the key into the HSM\n\nFirst export your 'original' AWS secrets\n\n```bash\n$ export AWS_ACCESS_KEY_ID=AKIAUH3H6EGK-redacted\n$ export AWS_SECRET_ACCESS_KEY=--redacted--\n\n## then seal it into softHSM (for example), follow https://github.com/salrashid123/aws_hmac/tree/main/example/pkcs\n\nmkdir /tmp/tokens\nwget https://raw.githubusercontent.com/salrashid123/aws_hmac/main/example/pkcs/softhsm/softhsm.conf\nexport SOFTHSM2_CONF=/path/to/softhsm.conf\n\n## make sure softHSM library exists at /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so \n$ git clone https://github.com/salrashid123/aws_hmac.git\n$ cd aws_hmac/example/pkcs\n\n## if using softhsm,\n### make sure SOFTHSM2_CONF is set and is pointing to the fully qualified path of softhsm.conf\n$ go run create/main.go --hsmLibrary /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so \\\n     -accessKeyID $AWS_ACCESS_KEY_ID   -secretAccessKey $AWS_SECRET_ACCESS_KEY\n\n## at this point your AWS key is loaded inside the HSM.\n### to construct the URI, run\n\n$ export PKCS_MODULE=/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so\n$ pkcs11-tool --module $PKCS_MODULE --list-token-slots\nAvailable slots:\nSlot 0 (0x5f3a6d79): SoftHSM slot ID 0x5f3a6d79\n  token label        : token1\n  token manufacturer : SoftHSM project\n  token model        : SoftHSM v2\n  token flags        : login required, rng, token initialized, PIN initialized, other flags=0x20\n  hardware version   : 2.6\n  firmware version   : 2.6\n  serial num         : e5cd05925f3a6d79\n  pin min/max        : 4/255\nSlot 1 (0x1): SoftHSM slot ID 0x1\n  token state:   uninitialized\n\n$ pkcs11-tool --module $PKCS_MODULE --list-objects  --pin mynewpin\nUsing slot 0 with a present token (0x5f3a6d79)\nSecret Key Object; unknown key algorithm 43\n  label:      HMACKey\n  ID:         0100\n  Usage:      verify\n  Access:     sensitive\n```\n\n\nThe PKCS URI for softHSM will use the serialnumber (`e5cd05925f3a6d79`), token (`token`), object (`HMACKey`), pin (`mynewpin`) and id (`0100`)\n(your values will be different)\n\n(please note this is **NOT** a comprehensive PKCS URI,  if you need modifications, please submit a PR)\n\n\nIn our case, the PKCS URI looks like..so go back to the root of this repo and test the standalone request\n\n```bash\nexport PKCS11_URI=\"pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;slot=0;serial=e5cd05925f3a6d79;token=token1;object=HMACKey;id=0100?pin-value=mynewpin\u0026module-path=/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so\"\n\nexport AWS_ACCESS_KEY_ID=AKIAUH3H6EGK-redacted\n\n## if using softhsm:\n# export SOFTHSM2_CONF=/full/path/to/softhsm.conf\n\n# test standalone credentials\ngo run load/main.go --pkcs-uri=$PKCS11_URI --aws-access-key-id=$AWS_ACCESS_KEY_ID --aws-region=us-east-1\n```\n\n### Configure AWS Process Credential Profiles\n\nTo test the process credential API and persistent handle, first download `aws-pkcs-process-credential` from the Releases section or build it on your own\n\nThis repo will assume a role  `\"arn:aws:iam::291738886548:user/svcacct1\"` has access to AssumeRole on `arn:aws:iam::291738886548:role/gcpsts` and both the user and role has access to an s3 bucket\n\n![images/role_trust.png](images/role_trust.png)\n\n\nEdit  `~/.aws/config` and set the process credential parameters \n\n```conf\n[profile sessiontoken]\ncredential_process = /path/to/aws-pkcs-process-credential  --aws-region=us-east-1 --aws-session-name=mysession --assumeRole=false  --pkcs-uri=\"pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;slot=0;serial=e5cd05925f3a6d79;token=token1;object=HMACKey;id=0100?pin-value=mynewpin\u0026module-path=/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so\" --aws-access-key-id=AKIAUH3H6EGK-redacted  --duration=3600\n\n[profile assumerole]\ncredential_process = /path/to/aws-pkcs-process-credential  --aws-arn=\"arn:aws:iam::291738886548:role/gcpsts\" --aws-region=us-east-1 --aws-session-name=mysession --assumeRole=true  --pkcs-uri=\"pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;slot=0;serial=e5cd05925f3a6d79;token=token1;object=HMACKey;id=0100?pin-value=mynewpin\u0026module-path=/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so\" --aws-access-key-id=AKIAUH3H6EGK-redacted  --duration=3600 \n```\n\n#### Verify AssumeRole\n\n\nTo verify `AssumeRole` first just run `aws-tpm-process-credential` directly\n\n```bash\n$ /path/to/aws-pkcs-process-credential  --pkcs-uri=$PKCS11_URI \\\n   --aws-arn=\"arn:aws:iam::291738886548:role/gcpsts\" --aws-region=us-east-1 --aws-session-name=mysession --assumeRole=true  --aws-access-key-id=$AWS_ACCESS_KEY_ID  --duration=3600 \n\n{\n  \"Version\": 1,\n  \"AccessKeyId\": \"ASIAUH3H6EGKIA6WLCJG\",\n  \"SecretAccessKey\": \"h7anawgBS5xNPlUcJ2P7x9YED5iltredacted\",\n  \"SessionToken\": \"FwoGZXIvYXdzEKz//////////wEaDK+OR7VuQewac2+redacted\",\n  \"Expiration\": \"2023-10-29T19:33:27+0000\"\n}\n```\n\nif that works, verify the aws cli\n\n```bash\n$ aws sts get-caller-identity  --profile assumerole\n{\n    \"UserId\": \"AROAUH3H6EGKHZUSB4BC5:mysession\",\n    \"Account\": \"291738886548\",\n    \"Arn\": \"arn:aws:sts::291738886548:assumed-role/gcpsts/mysession\"\n}\n\n# then finally s3\n$  aws s3 ls mineral-minutia --region us-east-2 --profile sessiontoken\n2020-08-10 02:52:08        411 README.md\n2020-11-03 00:16:00          3 foo.txt\n```\n\n#### Verify SessionToken\n\nTo verify the session token, first just run `aws-tpm-process-credential` directly\n\n```bash\n$  /path/to/aws-pkcs-process-credential  --pkcs-uri=$PKCS11_URI \\\n    --aws-region=us-east-1 --aws-session-name=mysession --assumeRole=false --aws-access-key-id=$AWS_ACCESS_KEY_ID  --duration=3600\n\n{\n  \"Version\": 1,\n  \"AccessKeyId\": \"ASIAUH3H6EGKFOX7G5XU\",\n  \"SecretAccessKey\": \"lwfjGGh41y/3RI0HUlYJFCK5LWxredacted\",\n  \"SessionToken\": \"FwoGZXIvYXdzEKv//////////wEaDOrG0ZqGoVCnU89juyKBredacted\",\n  \"Expiration\": \"2023-10-29T18:59:58+0000\"\n}\n```\n\nif that works, verify the aws cli\n\n```bash\n$ aws sts get-caller-identity  --profile sessiontoken\n{\n    \"UserId\": \"AIDAUH3H6EGKDO36JYJH3\",\n    \"Account\": \"291738886548\",\n    \"Arn\": \"arn:aws:iam::291738886548:user/svcacct1\"\n}\n\n# then finally s3\n$ aws s3 ls mineral-minutia --region us-east-2 --profile sessiontoken\n2020-08-10 02:52:08        411 README.md\n2020-11-03 00:16:00          3 foo.txt\n```\n\n\n### Testing\n\n```bash\nexport AWS_ACCESS_KEY_ID=redacted\nexport AWS_SECRET_ACCESS_KEY=redacted\nexport AWS_ROLE_SESSION_NAME=mysession\nexport AWS_DEFAULT_REGION=us-east-1\nexport AWS_ROLE_ARN=arn:aws:iam::291738886548:role/cicdrole\nexport AWS_ACCOUNT_ARN=arn:aws:iam::291738886548:user/testservice\nexport AWS_ROLE_SESSION_ARN=arn:aws:sts::291738886548:assumed-role/cicdrole/mysession\n\ngo test -v\n```\n\n---\n\n#### References\n\n- [TPM Credential Source for Google Cloud SDK](https://github.com/salrashid123/gcp-adc-tpm)\n- [PKCS-11 Credential Source for Google Cloud SDK](https://github.com/salrashid123/gcp-adc-pkcs)\n- [AWS Authentication using TPM HMAC](https://github.com/salrashid123/aws_hmac/tree/main/example/tpm#usage-tpm)\n- [AWS Configuration and credential file settings](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsalrashid123%2Faws-pkcs-process-credential","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsalrashid123%2Faws-pkcs-process-credential","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsalrashid123%2Faws-pkcs-process-credential/lists"}