Home / Articles / AWS from the vault / Versions / v1.2.0
AWS from the vault: what changed in v1.2.0
From v1.1.0 (2026-10-21, 2d1bfa2af) to v1.2.0 (2026-10-21, c06c9ae1e), paragraph by paragraph.
3 paragraphs added, 0 removed, 6 changed in place, 58 unchanged. About 204 words added and 4 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
# AWS from the vault: a proposed aws.sgit.ai,aws.twin.sgit.ai, where a temporary AWS session lives in the user's vault, the browser does the work, and AWS data finally has a place to go
Summary: I have wanted to build this for a long time: a website for managing AWS and working with its data, all on the client. aws.sgit.ai,It orwill somethingbe wider,aws.twin.sgit.ai, because it is a platformtwin orfirst: provideran site.AWS-shaped interface whose backend is a vault, with the live account put in front of it later as a second backend. Two pieces were always missing. The first was a safe place in the browser for the AWS credentials. The second was somewhere to put the data: the inventories, logs and costs you gather. Now that every user has a vault, both are solved. You sign in to the AWS access portal, IAM Identity Center, copy the temporary credentials for one account and role, which last from one to twelve hours, and paste them into your vault, which can itself be temporary. For that session the site can do whatever that role can do, from the browser, with the normal AWS SDK for JavaScript: an S3 browser, Lambda functions, EC2 instances, billing, logs. The results go back into the vault, where they are versioned and can be turned into graphs. The first job I want from it is a better way to deploy the SG/Send server components to many regions and accounts. There may be a PKI way to get the session as well: IAM Roles Anywhere exchanges X.509 certificates for temporary credentials. That is to test. This is a proposal.
2 unchanged paragraphs, under In short {#in-short}
• A website for managing AWS, all on the client. aws.sgit.ai, oraws.twin.sgit.ai, a widertwin platform or provider site.first.
12 unchanged paragraphs, under Two missing pieces {#missing}
A twin first {#twin}
The site has a name now: aws.twin.sgit.ai, part of the family at twins.sgit.ai. The name carries the design. It is built twin first: an AWS-shaped interface, for S3, Lambda, EC2, IAM, billing and logs, whose backend is a vault. The real connection, the temporary session below, is put in front of it as a second backend behind the same interface. Everything built against the twin then works against the live account, because the code is written against the interface, not the backend.
That is the pattern of the one twin that already works, the S3-compatible vault container, where code using boto3 cannot tell whether it is talking to S3, a vault, disk or memory. It means every part of the site can be built and tested on a vault, with no credentials at all, and every deployment rehearsed before it runs live. The naming, and the rule behind it, are in plural for the family, singular for the site.
36 unchanged paragraphs, under The workflow {#workflow}, The browser does the work {#browser}, A home for AWS data {#data}…
• Nothing here is built. aws.sgit.aiThe name is decided, aws.twin.sgit.ai, and its repository exists; the site does not exist yet, and its name is not decided.yet.
6 unchanged paragraphs, under The diagrams, as source {#diagrams}
``mermaid
flowchart TB
P["AWS access portal<br/>sign in, pick account and role"]
K["Temporary credentials<br/>one to twelve hours"]
subgraph V["The vault"]
C["The session's credentials"]
D["AWS data: inventories,<br/>logs, costs, snapshots"]
end
``B["aws.sgit.aiB["aws.twin.sgit.ai in the browser<br/>AWS SDK for JavaScript"]
A["AWS: S3, Lambda, EC2,<br/>IAM, billing, logs"]
G["Graphs and workflows"]
P -->|copy| K
K -->|paste| C
C -->|unlocks| B
B -->|calls| A
A -->|results| D
D --> G
2 unchanged paragraphs, under Where this comes from {#sources}
A voice memo of 21 October 2026. AWS's documentation, read the same day: getting IAM Identity Center user credentials, what is IAM Roles Anywhere, and the AWS SDK for JavaScript's pages on CORS and credentials in a browser. OSBot-AWS on GitHub and SG/Compute's site, and twins.sgit.ai on the S3 container, read the same day. sgit.ai's AWS page, for the templates and runbooks. Related: plural for the family, singular for the site, the user keeps the meter, PKI everywhere, agent workflows on ephemeral vaults, what can your agent reach?, knowledge that maintains itself. Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine.