Connect to AWS

Dynomatic reads the AWS profiles you already have and lets you create new ones in the app. A connection is a profile at a region, and the status bar along the bottom of the window is where you switch between them.

Use a profile you already have

Profiles in ~/.aws/config and ~/.aws/credentials are detected automatically and listed read-only, because the AWS CLI owns those files. To change one, edit it with the CLI and Dynomatic picks the change up.

Point AWS_CONFIG_FILE or AWS_SHARED_CREDENTIALS_FILE somewhere else and Dynomatic looks there instead, so aws-vault, granted, and per-project setups list the right profiles. AWS_PROFILE badges and pre-selects its named profile. Nothing connects automatically on startup. An app launched from Finder inherits a stripped environment, so these variables mostly apply when you launch from a terminal.

Note: Selecting a profile always resolves that profile’s own credentials. Environment credentials in your shell never take over a profile you picked by name. If a profile has no resolvable credentials, the error names the profile rather than connecting as somebody else.

Create a profile in the app

Open the workspaces popover from the status bar, or press ⇧ ⌘ P on macOS or Ctrl + Shift + P elsewhere, and choose Manage Profiles. The create flow asks for a credential type first, then shows the form for that type. There are six types.

• Access keys for a static key pair.
• MFA for a profile that needs a one-time passcode.
• IAM Identity Center SSO.
• AWS Login, the browser passkey sign-in driven by the AWS CLI.
• Local DynamoDB, with endpoint quick-picks for Dynoxide, DynamoDB Local, and LocalStack.
• Credential Process, for a program such as aws-vault export --format=json my-profile.

Test the connection before you save. Test Connection needs a region, as Save does. With Default Region empty, the field shows Region is required and nothing is tested. Secrets on profiles you create go to the OS keychain, never to the profile database, and are never sent back to the interface. In the edit form a secret field starts empty with an “Unchanged. Leave blank to keep” placeholder, so leaving it blank keeps the stored secret.

An assume-role chain builder sits on the same form, taking ordered roles with ARN, session name, external ID, duration, MFA serial, and an OTP shell command. Retry mode, max attempts, a CA bundle, and switches for FIPS and dualstack endpoints live under an Advanced disclosure.

The profile manager and the advanced credential types are Pro and Team features.

Regions

Region pickers list every AWS partition, grouped as AWS Standard, AWS GovCloud (US), and AWS China, and they accept free text. Type a region that is not listed, such as one in an ISO partition, and Dynomatic takes it as entered after checking only its shape. A malformed entry shows an inline error instead of being quietly corrected.

Custom endpoints

A profile’s custom endpoint applies to every AWS call that profile makes, covering DynamoDB, DynamoDB Streams, S3, STS, and EC2, including assume-role steps and MFA session-token calls. That is what makes a local stack like Dynoxide or LocalStack work end to end with nothing reaching real AWS. One endpoint covers every service, so mixing backends needs a single multi-service endpoint.

Connect

Sign-in differs by credential type.

SSO runs the OIDC device flow behind a dialog showing the verification code, with a copy link, cancel, and reconnect. Sessions are shared per [sso-session] across profiles and refresh silently in the background. Dynomatic also reads the AWS CLI’s own token cache, so a terminal aws sso login is picked up without a second browser prompt, and an expired session reconnects by itself once you log in again from the terminal.

MFA prompts for the one-time passcode as soon as it needs one. The six-digit input cleans pasted values and submits on its own, and Escape cancels. A connect runs once per workspace across the whole app, so a single-use passcode is never burned by two surfaces asking at the same time.

AWS Login drives aws login and aws logout and needs AWS CLI 2.32.0 or later. Dynomatic never writes AWS config files. A status panel reports whether the session is active, expiring, or expired.

Credential Process runs the external program directly, with no shell and a 60-second timeout, finding it on PATH and in the well-known install directories. If you use aws-vault, configure --prompt=osascript so keychain prompts do not need a terminal.

When any AWS call fails because credentials expired or were revoked, Dynomatic raises a toast naming the workspace, with a one-click recovery action routed to that credential type. The stale credentials are dropped as soon as the failure is seen, so the retry resolves fresh ones, and open data views refetch once the reconnect is verified.

Workspaces

A workspace is one AWS profile at one region, and it owns everything scoped to that pairing. Saved queries, saved scripts, table settings, command history, recent and favorite tables, variable environments, and tab groups all belong to a workspace. A workspace comes into existence the first time its profile and region are used, and it persists for life. Disconnecting never deletes it.

• Disconnect ends the session, closes the workspace’s tabs, and sets the workspace aside. It moves to the Connect a workspace list, where Connect brings it back with everything it owns.
• Cancel on a workspace that is still signing in abandons the sign-in and sets the workspace aside.
• A connected workspace whose session expired or failed stays in the popover and shows Reconnect.
• To delete a workspace and its data, open Connect a workspace and click Delete on its row. Disconnect a connected workspace first. The confirmation names the workspace and lists what goes with it.

When a profile disappears from ~/.aws/config, its workspaces are set aside with a Profile missing reason, and their Connect button stays inert. Put the profile back and the same workspace returns on its own.

Switch workspaces

The connections trigger in the status bar opens the workspaces popover. To open it from the keyboard, press ⇧ ⌘ P on macOS or Ctrl + Shift + P elsewhere. The trigger shows a green check when every connected workspace is fine and an attention indicator when one needs you. A session-elapsed readout sits beside it.

The popover lists your connected workspaces. Each row shows the workspace’s icon in its color, its name, its session status, one action button, and an edit pencil. The line under the name gives the credential type, the region, and the account ID. A workspace on a local endpoint reads Local · port <port> there instead. To switch to a workspace, click its row. On the query page, a workspace with no open tabs cannot be switched to until you open one of its tables.

Switching region means picking a workspace at that region, so the status bar has no separate region or profile pill. The popover footer holds two buttons.

• Connect a workspace lists the workspaces you set aside, with each one’s profile, region, and the date you last used it. Workspaces whose profile is missing come last. Add workspace sits at the bottom of the list.
• Manage Profiles opens the profile manager.

Add or edit a workspace

Add workspace opens one dialog with Profile, Region, Name, Icon, Color, and Table prefixes. Leave Name empty to use the profile and region as the name. Color takes a palette color or a #rrggbb hex value, and Table prefixes shows only the tables whose names start with one of the prefixes. When you submit, Dynomatic creates the workspace, connects it, and switches to it. If a workspace already uses that profile and region, the dialog offers Connect existing instead.

The pencil on a row opens the same dialog to edit the workspace, and so does Edit workspace in Settings → Workspace. The profile and region are fixed there, because they are the workspace’s identity. To use another pair, add a workspace.

The command palette also switches workspaces: type @ to list them.