Keep ~/.aws/credentials and ~/.aws/config in Crunu
Store AWS credentials and config files with their profiles intact, edit them section by section, and put them back on a laptop or server with one command.
- Support
- Works with Crunu today: AWS credentials files support is part of the product.
- Crunu features
- Encrypted vault and Machines
- Checked
- Against Crunu 6.0.0 on October 27, 2026
Crunu features that work with AWS credentials files
Each feature below works the same way in every integration: the server keeps ciphertext, and only the people, machines and tokens you grant can decrypt.
Encrypted vault
Keep .env files, cloud credentials and API keys in projects and environments, encrypted on your devices before anything reaches the server.
Learn more
Machines
Enroll a server with a one-time code, and the crunu agent keeps its environments in memory and starts your programs with them.
Learn more
How it works with AWS credentials files
On this page
What Crunu does with AWS credentials files
Crunu stores ~/.aws/credentials and ~/.aws/config as files with their paths, and edits them the way they're written: INI sections such as [default] and [profile staging], with fields inside each section. Values stay masked until you choose Show, and they're encrypted on your device before anything reaches the server.
Bring them in
Drag your .aws folder into an environment. Crunu recognizes both files by name and contents and sets their paths to .aws/credentials and .aws/config in your home directory. You can correct any path before saving. A personal project is a good home for your own keys; a shared project's environment suits keys a team or a machine needs.
Put them back on a machine
With the crunu command line, sign in and write the environment's files to their paths:
crunu pull --env dotfiles/laptop --dry-run
crunu pull --env dotfiles/laptopReplace dotfiles/laptop with your own project and environment. --dry-run prints the paths without writing anything. Each file is written with 0600 permissions, the previous version is kept as .prev, and every file is checked before any of them is moved into place.
Without the command line, download an install script for the environment's files from the browser and run it locally or on a server over SSH. It writes the same way and checks SHA-256 first.
Use them as environment variables instead
If a program reads AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from its environment, store them as variables in a .env file marked to load as environment variables, and start the program with crunu run. The values reach the program in memory and are never written to disk.
crunu run --env data-pipeline/production -- python etl.pyCareful with ~/.aws/config
~/.aws/config can run commands, for example through credential_process. When someone opens a share link, Crunu marks such files as able to run commands, along with shell startup files and SSH settings, and leaves them unselected in the install step. Install them only if you trust the sender.
When a key has to change
Crunu doesn't rotate keys at AWS. When someone leaves, the reissue checklist in the member removal wizard names the AWS keys they saw that are still in use, and AWS is one of the services Crunu links to the page where a new key is issued. Reissue the key at AWS and save the new value in the environment. Machines that hold the environment key get the new version at their next check.
Related
Questions and answers
Not covered here? Write to support@crunu.com and a person will answer.
Does Crunu connect to my AWS account?
No. It stores your credentials files and variables, and it doesn't sync with AWS Secrets Manager or Parameter Store.
Does Crunu rotate AWS keys?
No. When someone leaves, the reissue checklist names the keys to replace, and you reissue them at AWS.
How do I put the files on a new machine?
Run crunu pull for the environment, or download an install script from the browser.