Connect to AWS

Dynomatic reads the AWS profiles you already have and lets you create new ones in the app. A connection is a profile at a region, and the status bar along the bottom of the window is where you switch between them.

Use a profile you already have

Profiles in ~/.aws/config and ~/.aws/credentials are detected automatically and listed read-only, because the AWS CLI owns those files. To change one, edit it with the CLI and Dynomatic picks the change up.

Point AWS_CONFIG_FILE or AWS_SHARED_CREDENTIALS_FILE somewhere else and Dynomatic looks there instead, so aws-vault, granted, and per-project setups list the right profiles. AWS_PROFILE badges and pre-selects its named profile. Nothing connects automatically on startup. An app launched from Finder inherits a stripped environment, so these variables mostly apply when you launch from a terminal.

Note: Selecting a profile always resolves that profile’s own credentials. Environment credentials in your shell never take over a profile you picked by name. If a profile has no resolvable credentials, the error names the profile rather than connecting as somebody else.

Create a profile in the app

Open the profile switcher from the status bar, or press ⇧ ⌘ P, and choose Manage Profiles. The create flow asks for a credential type first, then shows the form for that type. There are six types.

• Access keys for a static key pair.
• MFA for a profile that needs a one-time passcode.
• IAM Identity Center SSO.
• AWS Login, the browser passkey sign-in driven by the AWS CLI.
• Local DynamoDB, with endpoint quick-picks for Dynoxide, DynamoDB Local, and LocalStack.
• Credential Process, for a program such as aws-vault export --format=json my-profile.

Test the connection before you save. Secrets on profiles you create go to the OS keychain, never to the profile database, and are never sent back to the interface. In the edit form a secret field starts empty with an “Unchanged. Leave blank to keep” placeholder, so leaving it blank keeps the stored secret.

An assume-role chain builder sits on the same form, taking ordered roles with ARN, session name, external ID, duration, MFA serial, and an OTP shell command. Retry mode, max attempts, a CA bundle, and switches for FIPS and dualstack endpoints live under an Advanced disclosure.

The profile manager and the advanced credential types are Pro and Team features.

Regions

Region pickers list every AWS partition, grouped as AWS Standard, AWS GovCloud (US), and AWS China, and they accept free text. Type a region that is not listed, such as one in an ISO partition, and Dynomatic takes it as entered after checking only its shape. A malformed entry shows an inline error instead of being quietly corrected.

Custom endpoints

A profile’s custom endpoint applies to every AWS call that profile makes, covering DynamoDB, DynamoDB Streams, S3, STS, and EC2, including assume-role steps and MFA session-token calls. That is what makes a local stack like Dynoxide or LocalStack work end to end with nothing reaching real AWS. One endpoint covers every service, so mixing backends needs a single multi-service endpoint.

Connect

Sign-in differs by credential type.

SSO runs the OIDC device flow behind a dialog showing the verification code, with a copy link, cancel, and reconnect. Sessions are shared per [sso-session] across profiles and refresh silently in the background. Dynomatic also reads the AWS CLI’s own token cache, so a terminal aws sso login is picked up without a second browser prompt, and an expired session reconnects by itself once you log in again from the terminal.

MFA prompts for the one-time passcode as soon as it needs one. The six-digit input cleans pasted values and submits on its own, and Escape cancels. A connect runs once per workspace across the whole app, so a single-use passcode is never burned by two surfaces asking at the same time.

AWS Login drives aws login and aws logout and needs AWS CLI 2.32.0 or later. Dynomatic never writes AWS config files. A status panel reports whether the session is active, expiring, or expired.

Credential Process runs the external program directly, with no shell and a 60-second timeout, finding it on PATH and in the well-known install directories. If you use aws-vault, configure --prompt=osascript so keychain prompts do not need a terminal.

When any AWS call fails because credentials expired or were revoked, Dynomatic raises a toast naming the workspace, with a one-click recovery action routed to that credential type. The stale credentials are dropped as soon as the failure is seen, so the retry resolves fresh ones, and open data views refetch once the reconnect is verified.

Workspaces

A workspace is one AWS profile at one region, and it owns everything scoped to that pairing. Saved queries, saved scripts, table settings, command history, recent and favorite tables, variable environments, and tab groups all belong to a workspace. A workspace comes into existence the first time its profile and region are used, and it persists for life. Disconnecting never deletes it.

• Disconnect ends the session only. The row stays, reads Disconnected, and offers Connect.
• Remove takes the workspace out of the connections popover and closes its tabs, but keeps everything it owns. Add the same profile and region again and it returns with all of it.
• Deleting a workspace and its data is a separate action. Open Settings, then Workspace, then Remove, then Remove workspace & data. The confirmation names the workspace and lists what goes with it.

When a profile disappears from ~/.aws/config, its workspaces stay visible as Disconnected under a passive Profile missing badge. Clicking the badge offers to archive the workspace, which hides it and everything it owns without deleting anything. Put the profile back and the same workspace returns on its own.

Switch profiles and regions

The status bar carries the switchers.

• The connections group lists one row per workspace, with its identity editor, status, details, and table filters, alongside Add Connection.
• The profile-count pill opens the profile switcher. Press ⇧ ⌘ P on macOS or Ctrl + Shift + P elsewhere.
• The region pill opens the region picker. Press ⇧ ⌘ R on macOS or Ctrl + Shift + R elsewhere.
• An activity indicator and a session-elapsed readout sit alongside them.

The command palette also switches profiles, under its :profile scope.