Migrating from aws-vault to Granted

I migrated to Granted after aws-vault development ended. Here is how role switching and console access differ, and what to check when carrying over credentials and configuration.

Takahiro Iwasa

2026-09-26

4 min read

When development stopped on aws-vault, which I used to manage AWS credentials, I looked for alternatives and migrated to Granted. The main differences are switching roles in the current shell and opening isolated consoles for multiple accounts.

What prompted the move

At the end of 2025, the 99designs/aws-vault README was updated to state that the project had been abandoned and would receive no further updates.

The notice also points to ByteNess/aws-vault. Updates stopped for 99designs/aws-vault; development did not end across all forks.

Using that fork was an option. While investigating other tools, I found Granted, which combines AWS role selection with the ability to keep consoles for multiple accounts open simultaneously.

Comparing aws-vault and Granted

This comparison is based on the official documentation for 99designs/aws-vault and Granted. The aws-vault fork is outside its scope.

Aspect	aws-vault	Granted
Main purpose	Store credentials securely and supply temporary credentials to commands	Select and switch roles, and access consoles
IAM access keys	Stores keys in an OS keystore or another supported backend	Supports secure storage through `granted credentials`
IAM Identity Center (SSO)	Supported	Supported, with encrypted SSO token caching
Terminal workflow	`aws-vault exec` launches a command or subshell	`assume` sets credentials in the current shell
Profile selection	Specify a profile name in the command	Specify a name or use an interactive search and selector
Console login	`aws-vault login`	`assume -c`, with sessions isolated through browser containers or profiles

Both tools support SSO. The workflow differences appear when selecting a profile to run commands or opening consoles for multiple accounts.

Replacing the basic commands

On macOS, install Granted with Homebrew using the commands in the Getting Started guide:

1
brew tap fwdcloudsec/granted
2
brew install fwdcloudsec/granted/granted
3
assume

Follow the initial prompts to configure the browser and shell alias, then open a new terminal. The examples below use dev and prod as names of already configured profiles.

With aws-vault, specify the profile and the command to run:

1
aws-vault exec dev -- aws sts get-caller-identity

With Granted, select a profile in the current shell and then run the AWS CLI:

1
assume dev
2
aws sts get-caller-identity

Where aws-vault exec dev starts a subshell, assume dev sets credentials in the current shell. Subsequent commands use the same credentials, so run get-caller-identity after switching accounts to confirm which account you are using.

To limit the use of those credentials to a single command, use Granted’s --exec option:

1
assume dev --exec -- aws sts get-caller-identity

Opening consoles for multiple accounts

Open a console for each profile with:

1
assume -c dev
2
assume -c prod

As described in the console guide, Firefox uses the Granted extension to isolate sessions in container tabs. Chromium-based browsers use separate browser profiles and windows.

This lets you compare development and production settings while keeping both sessions open. aws-vault also supports console login; Granted additionally handles opening isolated browser sessions.

Settings to check during migration

Granted uses the AWS CLI configuration files. However, a profile in ~/.aws/config and an access key stored in aws-vault are separate things. Reusing the configuration does not automatically migrate stored keys.

For SSO, check that you can sign in with each existing profile. For IAM access keys, register them with granted credentials add as needed. Granted’s credentials import reads a plaintext AWS credentials file; it is not a direct importer for aws-vault’s storage.

Check credential_process settings, shell aliases, and scripts for remaining aws-vault calls as well. If any remain, aws-vault is still required even after installing Granted. Verifying CLI and console access for each profile and updating those calls before removing aws-vault helps catch anything missed during migration.

Conclusion

I moved to Granted after development ended on 99designs/aws-vault, though the fork remains an option for keeping a similar workflow. Granted suits work that involves choosing profiles interactively or viewing consoles for multiple accounts side by side.

Migration involves more than replacing commands: stored credentials and settings that call aws-vault also need attention. Even when existing profiles can be reused, verify both CLI and console access before switching over.

Back to posts