AWS
Sync secrets to AWS SSM Parameter Store (auto-sync on change), or inject them at run time on Lambda, ECS, or EC2.
SSM Parameter Store — auto-sync
Connect AWS credentials (an IAM user with ssm:PutParameter / ssm:DeleteParameter), map a vault environment to an SSM path, and secret changes write SecureString parameters automatically.
# Connect (store static credentials — the access key id is not secret)
curl -X POST https://api.meowpass.dev/integrations/aws/connect \
-H "Authorization: Bearer $MEOWPASS_TOKEN" \
-d '{"access_key_id":"AKIA...","secret_access_key":"..."}'
# Map a vault env → an SSM path prefix in a region
curl -X PATCH https://api.meowpass.dev/integrations/<integration-id>/mappings \
-H "Authorization: Bearer $MEOWPASS_TOKEN" \
-d '{"project_mappings":[
{"vault_id":"<vault>","env":"production","region":"us-west-2","path_prefix":"/meowpass/my-app"}
]}'
# Writes now sync:
mp set DATABASE_URL postgres://... --env production
# → /meowpass/my-app/DATABASE_URL (SecureString) in us-west-2
Your app reads them via the SSM SDK or the Parameters & Secrets Lambda extension. Least privilege: scope the IAM user to your path_prefix.
Run-time injection
Prefer secrets never live in AWS? Inject at start-up:
# Container/instance env: MEOWPASS_TOKEN = mp_... · MEOWPASS_VAULT_ID = <vault>
mp run --vault $MEOWPASS_VAULT_ID -- ./your-server
Keyless agent access (STS)
For AI agents, hand out short-lived STS credentials instead of a stored key. Register an AWS tool in native mode with a role to assume; a native broker session mints self-expiring credentials via AssumeRole.
# Register an AWS tool (native mode) and set the role to assume
curl -X POST https://api.meowpass.dev/tools -H "Authorization: Bearer $TOKEN" \
-d '{"name":"aws","mode":"native"}'
curl -X PUT https://api.meowpass.dev/tools/<tool-id>/native-config -H "Authorization: Bearer $TOKEN" \
-d '{"role_arn":"arn:aws:iam::123:role/agent","region":"us-west-2","duration_seconds":"3600"}'
# Agent requests a native session, then mints temp creds
curl -X POST https://api.meowpass.dev/broker/sessions -H "Authorization: Bearer $AGENT" \
-d '{"tool_id":"<tool-id>","mode":"native"}'
curl -X POST https://api.meowpass.dev/broker/sessions/<session>/credential -H "Authorization: Bearer $AGENT"
# → { token: <session_token>, expires_at, meta: { access_key_id, secret_access_key, session_token, region } }
The credentials expire on their own — nothing long-lived is handed to the agent. Base credentials to call AssumeRole come from the MeowPass execution role (least-privilege, with an optional external_id).
Roadmap
- • Secrets Manager target (in addition to SSM)