Skip to content

AWS Key Dashboard

Tracx DevOps · account 723195533162

Access is granted by a dashboard admin. Sessions last 12 hours.

Choose your own password

An admin set your starting password. Replace it before continuing.

At least 12 characters.

AWS Key Dashboard

723195533162 · us-west-2

Job

Staging keys

staging01 · custom-staging tenants
    / to search · click a row for details

    Production keys

    production01 · custom-production tenants
      Production — one tenant at a time is the safe way. Rotating asks you to type the tenant's name. Selecting several works too: you type production, and the batch stops at the first rotation that does not finish cleanly.
      / to search · click a row for details

      Personal keys

      people's own CLI keys
        Only the owner can create the new key — an admin assigns each key's owner below. The new secret is shown once and the dashboard keeps no copy. The laptop CLI runs as Penny: update ~/.aws/credentials there before deactivating Penny's old key.

        Dev & shared keys

        dev01 · atlas · waypoint
          These keys sit outside the dashboard's write scope. The clock still runs, so you can see which one is due next, but the rotation itself is done by hand or with scripts/rotate-staging-keys.py — the row shows every place that has to be updated.
          / to search · click a row for details

          Inactive keys

          users with nothing working left — delete their keys from here
          Only genuinely dead keys appear here. A key is listed when all three are true: it is switched off, its IAM user has no Active key left at all, and nothing has signed with it in the last 30 days. A key that fails any of those is still attached to something live — a rotation still running, a user who has a working key, or a service that was using it until days ago — and it stays on its scope tab or, if it needs attention, on the Security tab. Deleting is permanent: an Inactive key can be switched back on at any moment, a deleted one is gone for good. Keys belonging to users outside the dashboard's write scope are listed too — those you delete in the console, and the row hands you the command.
          click a row for details

          Every access key

          Rotation history

          every rotation — from this dashboard or the CLI scripts

          Activity

          recent scans, rotations, deactivations and deletions

          Security check

          runs on its own once a day
          Every key in the account is checked once a day, along with the settings that decide whether a key can leak in the first place. Each finding says plainly what to do about it — a list of problems with no next step is just noise. Nothing here changes anything on its own.

          Who can sign in

          Nobody is emailed. You get a starting password to pass on directly — they must change it the first time they sign in.

          Dashboard users
          EmailRoleAdded byAddedLast sign-inActions

          Create a Waypoint login

          pick an environment
          This writes a row into the chosen environment's own users table and a matching one into organization_memberships, in one transaction — a user without a membership cannot log in. The password is hashed here and never stored or shown again.
          This is production. The account you create here can sign in to the live product alongside real customers.

          Existing accounts

          reset a password, change role or organisation, or switch an account off

          History

          every account this dashboard has created or changed — never a password
          loading…

          Create a database login

          pick an environment
          A Postgres role on the environment's own database — not a Waypoint login. It is granted CONNECT, USAGE on public, table and sequence privileges, and default privileges so tables added later are covered too.
          This is production. A role created here reads live customer data directly.

          Existing database logins

          reset a password, or drop a role

          pick an environment above

          New key for

          A new access key is created and shown to you once. The current key keeps working until you deactivate it (step ③), so nothing breaks while the new one is being installed.

          Asked again because this hands out an AWS credential.

          Save it now — shown only once

          The dashboard kept no copy of the secret. Close this without saving it and the new key is useless — you would deactivate and delete it and start again.
          AWS had not accepted the new key yet when this finished — usually propagation. Wait a minute before testing.
          Access key ID
          Secret access key
          ② Replace the old values in ~/.aws/credentials (or wherever this key is used) and run aws sts get-caller-identity — it must print your user. ③ Come back and press Deactivate old. ④ Delete old after 7 days.