Credential helpers and role chains

CloudPouch supports generic credential_process profiles, plus non-MFA role chains over helper-backed or aws login-backed source profiles. This page is the authoritative list of what that covers and, more usefully, what it does not — if your profile shape appears under Profile shapes CloudPouch does not resolve, no CloudPouch setting will make it work.

Generic `credential_process` profiles

A profile in ~/.aws/config whose credential_process names an external helper works everywhere a profile is used in CloudPouch — Billing, Compare, Cost Insights, and the Savings Workspace.

[profile client-prod]
credential_process = /opt/homebrew/bin/aws-vault export client-prod --format=json
region = eu-west-1

The support is generic. CloudPouch runs whatever command the profile names, the same way the AWS CLI does, without a shell. It does not special-case particular helper products, so aws-vault, Granted, saml2aws, and in-house corporate helpers are all just commands to CloudPouch.
CloudPouch uses the short-lived credentials the helper prints, and refreshes them automatically when they expire — a long Savings Scan keeps running instead of failing part way through.
Helpers start with your login-shell PATH, so a helper installed through Homebrew, asdf, mise, or nix is found even when you launch CloudPouch from the Dock rather than from a terminal.

No AWS CLI version requirement

The AWS CLI 2.32.0 requirement applies to aws login (login_session) profiles only. A credential_process profile needs no AWS CLI at all, because CloudPouch runs whatever command the profile names. If aws-vault or your corporate helper is the only AWS tooling on the machine, that is enough.

About aws-vault specifically

aws-vault works with CloudPouch when it is invoked as a credential_process helper, as in the example above. That is the whole of the claim: several common aws-vault profile shapes — including its private MFA profiles — are not resolved, and they are listed below. Treat “aws-vault works with CloudPouch” as true only for the helper-command setup, never as blanket compatibility.

A profile that assumes a role with role_arn + source_profile on top of a credential_process-backed or aws login-backed profile works, and so do multi-hop chains — up to ten role hops above the profile that actually holds the credentials.

[profile client-audit]
role_arn = arn:aws:iam::111111111111:role/CostReadOnly
source_profile = client-prod

MFA is the boundary. A chain that requires you to type an MFA token code is not resolved, because CloudPouch cannot drive an MFA prompt itself.

Plain IAM Identity Center (SSO) profiles and static-key profiles behave exactly as they always have. Role-chain support is limited to the configurations described on this page — a chain whose source profile is an SSO profile is not resolved. See AWS credentials and SSO profiles.

When a credential helper fails

A helper that fails does not produce a swallowed or generic error. CloudPouch shows a callout naming what went wrong and what to do next, with a sanitized one-line diagnostic: the helper file name, the exit code, and the problem category. The categories are:

the helper is missing;
the helper needs an MFA prompt driver (for example aws-vault’s --prompt=osascript on macOS);
the keychain is locked;
the helper timed out;
the helper printed output CloudPouch cannot use.

Helper output is never logged, never shown raw, and never transported to the CloudPouch interface. A credential helper can print credentials on its own error channel, so CloudPouch treats everything it prints as sensitive.

Profile shapes CloudPouch does not resolve

These shapes are outside the supported scope. Each one produces its own specific message in CloudPouch naming the profile and the configuration it cannot resolve, rather than a generic credentials failure — so you find out immediately, not after a failed scan.

aws-vault-private MFA profiles — source_profile + mfa_serial with no role_arn.
role_arn + mfa_serial — an MFA-gated role assumption.
credential_source = Ec2InstanceMetadata, EcsContainer, or Environment.
Role chains whose source profile is an IAM Identity Center (SSO) profile. A plain SSO profile still works; it is the chain rooted on one that does not.
web_identity_token_file.
include_profile.
source_identity.
session_tags.
Windows .cmd / .bat helpers — CloudPouch starts every helper without a shell, so a .cmd or .bat file cannot run directly as credential_process.

If your profile matches one of these shapes, check the alternatives below.

What to do instead

For the two MFA shapes (1 and 2), let the helper own the MFA-gated work and hand CloudPouch the result. Point a wrapper profile’s credential_process at aws-vault, or an equivalent helper, so the helper performs the MFA-gated export or role assumption itself, instead of configuring the MFA-only profile as CloudPouch’s source profile.

For Windows .cmd / .bat helpers (9), point credential_process at a native executable, or invoke the script’s interpreter directly — the interpreter binary with the script as its argument — rather than at the .cmd or .bat file.

For the remaining shapes there is no CloudPouch-side setting to change. The general pattern that works is the same one: if something on the machine can produce credentials as a command, a wrapper profile whose credential_process runs that command is a profile CloudPouch resolves. That pattern does not fit every shape in the list — a profile built on environment credentials or a web identity token may have no such command behind it — so check what your organization’s tooling can actually export before rebuilding a profile around it.

What support means here

Support means CloudPouch resolves the profile, runs its helper without a shell, and refreshes the credentials it gets back for as long as your work takes. If a shape this page calls supported fails for you, treat it as worth reporting rather than assuming it belongs on the unsupported list.