AWS credential management
Keep AWS access tied to a project and a person.
Shortspan brings AWS account credentials into the same project catalog as secrets, servers, databases, and runbooks. Developers invoke approved cloud commands through the CLI instead of maintaining a growing collection of shared profiles.
Why teams change
Cloud profiles are easy to create and hard to govern.
Shared access keys and long-lived local profiles blur the line between environments and make it difficult to answer who still has working access. The risk grows as teams add accounts, contractors, CI jobs, and emergency procedures.
Shortspan keeps registered AWS targets under workspace and project permissions. Authorized users can run commands with the selected cloud context, while temporary grants and audit events provide a reviewable boundary around the brokered use.
What Shortspan adds
Control around the workflow, not another workflow beside it.
Project-aware account aliases
Name AWS access by the account, workload, or environment your team understands instead of relying on undocumented local profile conventions.
CLI execution context
Run an AWS CLI command with the registered context supplied for that process, subject to the requester permissions.
Scoped automation tokens
Give automation its own token abilities rather than reusing a human credential, and keep machine activity attributable to that token.
The workflow
From registered resource to accountable use.
- 01
Register the AWS target
Place the account credential and descriptive alias inside its owning project.
- 02
Set the access boundary
Use project roles, temporary requests, and token abilities for the people and jobs that need it.
- 03
Execute with cloud context
Call the AWS CLI through Shortspan so the approved context is available to the command without a shared profile handoff.
Operational outcomes
Make the secure path the understandable path.
- Fewer shared AWS profiles on developer devices
- Clearer separation between cloud accounts and environments
- Independent credentials and permissions for automation
- An attributable record of brokered cloud access
Common questions
Know where the boundary is.
- Does Shortspan replace AWS IAM?
- No. AWS IAM remains the authority for what the underlying AWS identity can do. Shortspan governs who may request and use the registered credential through its workflow.
- Does Shortspan automatically create temporary AWS STS credentials?
- Do not assume that for every target. Shortspan brokers the configured AWS credential workflow; dynamic credential behavior depends on the integration and source identity you configure.
- Can automation use AWS access?
- Yes. Scoped API tokens are designed for non-human callers, with abilities selected for the job rather than inherited from a developer account.
Read the implementation details
Documentation for this workflow
Related solutions
Connect the next part of the workflow
Start with one project and one access problem.
Create a workspace free, or tell us what your team needs to broker, approve, and review.