Accounts and credentials

Every AWS account Douklar talks to is a profile. A profile holds that account's credentials and nothing else; each account is reached with its own profile.

Credential sources

Each profile uses one of:

• Static access keys, stored encrypted at rest in the app's credential store.
• IAM Identity Center (SSO), signed in from the app with a device login, with role selection and an optional single-hop AssumeRole.

A profile's preference decides which source it uses. Douklar uses only the credentials configured in the profile; it does not read ambient credentials from the host or container, so a run uses an identity you configured.

Account checks

Douklar verifies each account with AWS STS on an interval you choose: Off, 5, 15 (default), 30, 60 or 240 minutes. The open console triggers these checks; there is no server-side scheduler.

A failed check appears on the Overview under "Needs attention", with the account and the error AWS returned.

Credential expiry and runs

Preflight checks whether a profile's credentials will expire during the run. By default it warns; it can be set to block. The default margin is 900 seconds.

Source and destination

A mapping needs two different profiles. They may point at the same AWS account (same-account mode), but an overlap guard refuses a mapping whose source and destination are the same resource.

What is protected

• Static keys, SSO sessions and provider secrets are encrypted at rest.
• Logs and errors redact authorization headers, cookies, session ids and presigned URL signatures.
• Commands run without a shell, from an allowlist (aws, git, oras), by absolute path.