credstash

What it is and what it does

CredStash is a credential management tool that integrates AWS KMS (for key encryption) and DynamoDB (for credential storage) to securely store, version, and distribute secrets across your infrastructure. It wraps each secret with a unique data encryption key encrypted by your KMS master key, then stores both the encrypted secret and wrapped key in DynamoDB. When you retrieve a secret, CredStash fetches the encrypted credential and key from DynamoDB, decrypts the key via KMS, and uses it to decrypt the secret.

The tool is designed for teams that want a lightweight, AWS-native alternative to dedicated secret-management systems. It supports versioning (so you can rotate credentials by creating new versions), encryption context (for audit trails and fine-grained access control via KMS policies), and simple CLI operations (put, get, list). However, the project has been abandoned since 2022 with no active maintenance, so it may not be compatible with current AWS SDK versions or modern Python environments without manual updates.

Use it for:

• Store database passwords and API keys in DynamoDB, encrypted by KMS, for retrieval during application bootstrap.
• Rotate credentials by creating new versions of a secret and updating client code to fetch the latest version.
• Audit credential access by associating encryption context with secrets and reviewing KMS CloudTrail logs.
• Distribute secrets to multiple servers or containers by having them fetch from the same DynamoDB table using shared KMS permissions.
• Manage TLS/SSL certificates and private keys with fine-grained access control via KMS Key Policy conditions.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

CredStash stores and retrieves secrets using AWS KMS for encryption and DynamoDB for storage, providing a simple credential management system for applications and infrastructure.

No—the project is abandoned (last release April 2020, last commit February 2022) and likely incompatible with current AWS SDK and Python versions. For new projects, use AWS Secrets Manager or Parameter Store instead. Only consider it for legacy systems already running CredStash that cannot be migrated.

Install

credstash on PyPI

pip install credstash

uv add credstash

poetry add credstash

Installing credstash

Before you install

Low install friction on macOS and Windows; Linux requires build tools and development headers for the cryptography dependency (libssl-dev, libffi-dev, build-essential on Debian/Ubuntu; gcc, libffi-devel, openssl-devel on Fedora/RHEL). Project is abandoned as of 2022, with no releases since April 2020.

License in practice

Licensed under Apache 2.0 (permissive), allowing commercial use, modification, and distribution with minimal restrictions—suitable for most organizational contexts.

Quickstart

pip install credstash

import credstash

# Requires AWS credentials and KMS key setup
secret = credstash.getSecret(name='myapp.db.prod')

AWS credentials must be configured (environment variables, ~/.aws/credentials, or IAM role); a KMS key named 'credstash' and a DynamoDB table must exist; on Linux, build tools and libssl-dev/libffi-dev headers required before pip install.

Verify before relying

• Current compatibility with modern versions of boto3 and cryptography, given the project's abandonment in 2022.
• Whether the package works with current AWS API versions and DynamoDB behavior.
• Support status for Python versions beyond those tested during active maintenance.

Package facts

Evidence: credstash-1.17.1-py3-none-any.whl

Tags

More Security packages