# Install aws-spiffe-workload-helper with Homebrew Helper for providing AWS credentials to workloads using their SPIFFE identity. Version 0.0.5 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:aws-spiffe-workload-helper ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install aws-spiffe-workload-helper ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:aws-spiffe-workload-helper - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.0.5 - **Source summary:** Helper for providing AWS credentials to workloads using their SPIFFE identity - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - aws-spiffe-workload-helper (cli) - aws-spiffe-workload-helper (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.0.5 - Local data: ok - Upstream repository: https://github.com/spiffe/aws-spiffe-workload-helper - Upstream latest detected: v0.0.5 (current) - info: No package-manager update timestamp was available. ## Project history and usage AWS SPIFFE Workload Helper is a SPIFFE project helper for obtaining AWS credentials from SPIFFE workload identities. ### Project history The official README describes the helper as a lightweight tool for providing workloads with AWS credentials using SPIFFE identity, with support for X.509 SVIDs through AWS Roles Anywhere and JWT SVIDs through AssumeRoleWithWebIdentity. ### Adoption history The repository is a SPIFFE tiny-project and remains a narrow integration tool rather than a broad CLI ecosystem. Its GitHub releases reached v0.0.5 on February 16, 2026. ### How it is used Users configure AWS SDKs and CLIs by setting `credential_process` in `~/.aws/config` to invoke `aws-spiffe-workload-helper`. The helper can return credentials to stdout or write a user-specified credential file for legacy consumers. ### Why package nerds care The package is notable because it bridges SPIFFE Workload API identity, AWS Roles Anywhere, AWS STS, and the AWS external credential process contract in a single distributable binary. ### Timeline - 2024: Initial public development began in the official repository. - 2025: Early v0.0.x releases were published. - 2026: v0.0.5 was published on GitHub Releases. ### Related projects - SPIFFE and the SPIFFE Workload API provide the identity source. - AWS Roles Anywhere and AWS STS AssumeRoleWithWebIdentity provide AWS credential exchange targets. - AWS rolesanywhere-credential-helper is the AWS tool the README compares this helper against. ### Sources - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ~/.aws/config ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** aws-spiffe-workload-helper - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Related links - [Cloud CLI packages](https://www.automicvault.com/pkg/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [amazon-ecs-cli](https://www.automicvault.com/pkg/brew/amazon-ecs-cli/) - Shares av.db curated category or tags: aws, cli, cloud-infrastructure. - [aws-amplify](https://www.automicvault.com/pkg/brew/aws-amplify/) - Shares av.db curated category or tags: aws, cli, cloud-infrastructure. - [aws-cdk](https://www.automicvault.com/pkg/brew/aws-cdk/) - Shares av.db curated category or tags: aws, cli, cloud-infrastructure. - [aws-console](https://www.automicvault.com/pkg/brew/aws-console/) - Shares av.db curated category or tags: aws, cli, cloud-infrastructure. - [aws-elasticbeanstalk](https://www.automicvault.com/pkg/brew/aws-elasticbeanstalk/) - Shares av.db curated category or tags: aws, cli, cloud-infrastructure. - [aws-es-proxy](https://www.automicvault.com/pkg/brew/aws-es-proxy/) - Shares av.db curated category or tags: aws, cli, cloud-infrastructure. - [aws-google-auth](https://www.automicvault.com/pkg/brew/aws-google-auth/) - Shares av.db curated category or tags: aws, cli, cloud-infrastructure. - [aws-iam-authenticator](https://www.automicvault.com/pkg/brew/aws-iam-authenticator/) - Shares av.db curated category or tags: aws, cli, cloud-infrastructure. ## Combined YAML source View the package source record on GitHub. [combined/aws-spiffe-workload-helper.yml](https://github.com/automic-vault/db/blob/main/combined/aws-spiffe-workload-helper.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph