Security Token Service support for AWS S3

Hi,

WinSCP is a very powerful software, but it's also very easy to users even for normal end users who do not have technology background. A suggestion here, can we have Security Token Service support for AWS S3 like Cyberduck?
https://docs.cyberduck.io/protocols/s3/#connecting-using-assumerole-from-aws-security-token-service-sts

Thanks,
Jun Gao

Thanks for your post.

This request has been added to the tracker:
Issue 1839 – Authentication using temporary credentials from AWS Security Token Service (STS)
You can vote for it there.

I have sent you an email with some questions.

This has been implemented. I'm sending you a development version of WinSCP for testing.

Can you link to the how to? I have been searching.

@fscalzo: Link what? I do not understand.
This? https://winscp.net/eng/docs/ui_login_s3#authentication
Make sure you have the latest version of WinSCP.

With Amazon SSO you get temporary keys instead of having to create an IAM user for S3 users but they only work with a session token as well.

One work around would be to have a place to put the session token and pass it or to pull from the .AWS/Credentials file based on a profile that is pre saved.

In my previous post, I've posted a link that shows where to put the Security token (session token). Did you check it?
https://winscp.net/eng/docs/ui_login_s3

Additionally, the next version of WinSCP will support reading AWS configuration:
Issue 1941 – Support reading S3 credentials from AWS CLI configuration

Hi

First off, avid user of WinSCP, thank you for a great app!

I access a number of S3 buckets and have multiple AWS profiles. Due to security changes I need to use temp credentials. In Cyberduck one can select the profile and path and it connects to the different S3 bucket using the selected profile from the AWS credentials and config.

I tried the new version WinSCP version and ticked the box to read credentials from the AWS CLI configuration but I'm not having any luck due to the multiple profiles.

When I do it manually for a specific profile and input the temp aws_access_key_id, aws_secret_access_key and aws_security_token it works.

Is it possible to add a feature to specify the use a specific profile?

@Meerkat: WinSCP does not have a way to select an AWS profile (yet). All you can do atm is to create e.g. a desktop shortcut that starts WinSCP with the profile set via AWS_PROFILE environment variable.

Thanks, for the feedback. Do you have a dummy example of how to set the the cli command AWS_PROFILE parameter in the desktop shortcut link?

Create a shortcut with a target like this:
Optionally you can even add session name to WinSCP.exe command line to have it open the session automatically.

This naive approach might popup console window briefly. There are more complex methods that avoid that.

Request added to the tracker:
Issue 2057 – AWS S3 profile selection