Dynomate
Browse documentation

AWS profiles

On this page8
  1. 1How Dynomate finds profiles
  2. 2Access-key profiles
  3. 3MFA profiles
  4. 4SSO profiles
  5. 5AWS Login profiles
  6. 6Local profiles
  7. 7Discover profiles and Regions
  8. 8Troubleshooting

How Dynomate finds profiles

Dynomate reads the standard AWS shared files:

  • ~/.aws/config on macOS and Linux, or %USERPROFILE%\.aws\config on Windows
  • ~/.aws/credentials on macOS and Linux, or %USERPROFILE%\.aws\credentials on Windows

Dynomate merges matching profile names from both files. In the config file, use [default] for the default profile. Use [profile name] for each named profile. In the credentials file, use [default] or [name].

Restart Dynomate after you add or rename a profile. The app loads the profile list when it starts.

Access-key profiles

An access-key profile uses an access key ID and a secret access key. Keep these values in the credentials file, not in project files.

INI
~/.aws/credentials 
[development]aws_access_key_id = YOUR_ACCESS_KEY_IDaws_secret_access_key = YOUR_SECRET_ACCESS_KEY
INI
~/.aws/config 
[profile development]region = us-east-1

When you select the profile, Dynomate calls AWS Security Token Service (STS) to verify the identity. STS is an AWS service that checks credentials and returns the current account and role identity.

MFA profiles

MFA means multi-factor authentication. Add mfa_serial to the profile that owns the access keys. Dynomate asks for a six-digit code when the cached session has expired.

INI
~/.aws/config 
[profile engineering]region = ap-southeast-2mfa_serial = arn:aws:iam::123456789012:mfa/developer[profile production-read]source_profile = engineeringrole_arn = arn:aws:iam::210987654321:role/ReadOnlyregion = ap-southeast-2
  1. Select the MFA profile in Table Discovery.
  2. Enter the current six-digit MFA code.
  3. Select Submit.
  4. Wait for Authentication successful.

Dynomate stores temporary MFA session credentials in the standard AWS CLI cache at ~/.aws/cli/cache. The session expires after the time set by AWS. The current Dynomate MFA request asks AWS for a 12-hour session.

SSO profiles

AWS SSO is the previous name for AWS IAM Identity Center. Dynomate detects a profile as SSO when it contains sso_start_url or references an sso_session section.

SSO profiles are included in the 14-day trial and in Professional and Enterprise. See SSO Authentication for configuration and sign-in steps.

AWS Login profiles

Dynomate detects a profile as an AWS Login profile when it contains login_session. The AWS CLI command aws login adds this key. A role profile that uses a Login profile as its source_profile also uses AWS Login.

See AWS Login for configuration and sign-in steps.

Local profiles

A local profile defines an endpoint_url that points to a loopback address such as localhost or 127.0.0.1. Use it for DynamoDB Local or LocalStack.

INI
~/.aws/config 
[profile dynamodb-local]region = us-east-1endpoint_url = http://localhost:8000aws_access_key_id = localaws_secret_access_key = local

Dynomate labels this profile as Local. It does not call STS for a loopback endpoint. Table Discovery allows one Region at a time for a local profile.

Dynomate does not discover Amazon Aurora DSQL clusters for a local profile. A profile-wide endpoint_url never applies to Aurora DSQL. See Aurora DSQL API endpoints.

Discover profiles and Regions

  1. Open Settings and select Table discovery. You can also select Manage AWS profiles in Global Search.
  2. Select an AWS profile.
  3. Complete the authentication step shown for that profile.
  4. Filter the Region list if necessary.
  5. Select one or more Regions.
  6. Select Load Tables.

Selecting a different profile clears the selected Regions. Each loaded table keeps the profile and Region that Dynomate used to discover it. Return to Table Discovery when you want to load tables for another profile or Region.

Table discovery
Table Discovery results for DynamoDB and Athena resources grouped by AWS Region
Table Discovery groups the resources found in each selected Region.

Troubleshooting

The profile is not listed

  • Check the profile section name in the AWS files.
  • Check that the files are in the standard AWS directory.
  • Restart Dynomate after you change the files.

Dynomate reports invalid credentials

  • Check that the access key is active.
  • Check that the secret key matches the access key ID.
  • Select Refresh after you update the file.

Dynomate reports MFA required

  • Check the mfa_serial value.
  • Enter a current six-digit code.
  • Check the system clock if AWS rejects a current code.

No tables are returned

  • Check that you selected the Region that contains the table.
  • Check that the AWS identity can call dynamodb:ListTables.
  • Review the result for each Region and Logs.