Aws-vault: Clean way of killing --server mode

[davidski]

When I am forced to run --server mode (MacOS) for testing various bits of code I currently have to grep for the aws-vault process and manually kill the spawned process when complete. This seems inelegant. 😜 Is it practical to have a --server-stop or other option to have aws-vault (robustly) figure out the correct process and send the kill signal? This would improve the UX for a lot of the devs that I support.

Thanks for the fantastic tool!

[irgeek]

I agree that a built-in way to stop the server would be great, but to work around having to grep for the PID and using kill to send the signal, you could try killall. It's _sort of_ like grep and kill rolled into one and I'm pretty sure it's available by default in macOS.

To get details about processes that would be sent a signal, you can use it like this:

killall -d aws-vault

To actually send the signal (TERM by default, like kill), you can use it like this:

killall aws-vault

[mtibben]

I think the "right" way to do this is to use launchd to launch the helper daemon, that way it could also be stopped and controlled with launchctl

[hunttom]

Additionally, recommend killing http.NewServeMux with http.Server shutdown. I have the code written if you want me to do a PR

[mtibben]

What if we get the proxy to handle a /kill route, which shuts it down? Might be a simpler solution than integrating with init systems over multiple platforms.

[mtibben]

So I was looking into this some more, and was exploring ways to kill the child process when aws-vault exits. But the proxy process is run as root, and this is actually the reason it's long-lived. If we kill the proxy process, it means every time we invoke aws-vault exec --server we need to re-enter credentials in order for it to sudo aws-vault server

So bottom line is that this is a helper process that is designed to run in the background so that you don't have to continuously enter sudo credentials.

This could be handled more elegantly using the OS service manager like systemd or launchctl

[nitrocode]

Hi all. Is there a simple launchctl plist that you folks are using that you'd be willing to share to use aws-vault exec <profile> --server ?

My attempt: https://github.com/99designs/aws-vault/issues/718

[myoung34]

@mtibben did something change between your comment here about using launchd but in #735 having a conflicting comment?

Adding a feature like this enables aws-vault to run in the background permanently - and this seems to me to be in opposition to that central goal of what aws-vault is trying to accomplish.