CloudLatch

Support & setup.

Configure an IAM user source, authenticate with MFA and work with temporary role credentials.

On this page
Development-stage guidance

CloudLatch is being prepared for distribution. These instructions describe the current implementation; no public download is available yet.

Before you begin

  • A Mac running macOS 14 or later.
  • An AWS configuration directory containing a named IAM user profile with access keys.
  • An MFA device for that IAM user and permission to obtain an MFA session and assume the intended roles.
  • Role ARNs and matching AWS permissions and trust policies supplied by your AWS administrator.

AWS CLI installation is not required. IAM Identity Center / SSO, credential_process, role-based source profiles and temporary source credentials are not currently supported.

Set up CloudLatch

  1. Open Settings… from the menu bar and choose your AWS configuration directory. The folder picker can show hidden folders.
  2. Enter the source IAM user profile name and MFA device serial ARN. The source profile must differ from default and every output profile.
  3. Import role entries using one alias=role-arn entry per line. Use the role ARNs provided by your administrator.
  4. Save the configuration. Use Refresh <alias>... and enter an MFA code to assume the selected role.
What refreshing changes

CloudLatch replaces credentials in the selected role profile and default. Other profiles and unrelated keys are preserved. Any tool using default will therefore use the newly written credentials.

Changing the directory or authentication configuration invalidates the cached source session and requires fresh MFA. Existing app configuration can be imported explicitly from Settings.

Troubleshooting

Why is a new MFA code required?

The source MFA session has expired or the authentication configuration changed. Enter a fresh code when prompted. CloudLatch requests a 12-hour source session; actual expiry is determined by AWS.

Why did automatic renewal stop?

Renewal depends on a valid source session, network access, directory access and AWS permissions. The app attempts renewal five minutes before role expiry. Check both source and role expiry, then refresh the selected role if needed.

Why can’t the app access my AWS files?

Choose the directory again in Settings to grant access. Check that the source profile exists and is supported. The app rejects ambiguous or invalid files and source/output profile collisions rather than overwriting them.

AWS denied the request. What should I check?

Ask your AWS administrator to check the source IAM user’s permissions, MFA device, role trust policy and requested role. Do not paste credentials or unredacted AWS errors into public reports.

Remove local data

The data removal instructions cover Keychain entries, local app files and temporary credentials written to your shared AWS file. Quit the app first. Uninstalling alone does not revoke AWS sessions or remove every stored copy.

Bugs, incidents & questions

Use the GitHub issue chooser to select a bug, incident, feature request or support question. English and Polish reports are welcome. A GitHub account is required.

Include the app version, macOS version, expected and actual behavior, and minimal reproduction steps. For incidents, include impact, start time with timezone, current status and any workaround.

Issues and attachments are public.

Never include access keys, session tokens, MFA codes, account IDs, ARNs, credential files, private infrastructure details or unredacted screenshots and logs. Use fictional examples.

Security reports

Report suspected vulnerabilities or credential exposure through GitHub private vulnerability reporting. Do not create a public issue with exploit details. Never attach actual credentials, even privately.

If credentials may have been exposed, revoke or rotate them through AWS independently of the report. No fixed support response time or bounty is promised.