---
id: credstash
version: "1.17.1"
license: Apache2
license_treatment: permissive
maintenance: abandoned
---

# credstash — A utility for managing secrets in the cloud using AWS KMS and DynamoDB

License: permissive · Maintenance: abandoned · Downloads: 490.2K/mo

## What it is and what it does

CredStash is a credential management tool that integrates AWS KMS (for key encryption) and DynamoDB (for credential storage) to securely store, version, and distribute secrets across your infrastructure. It wraps each secret with a unique data encryption key encrypted by your KMS master key, then stores both the encrypted secret and wrapped key in DynamoDB. When you retrieve a secret, CredStash fetches the encrypted credential and key from DynamoDB, decrypts the key via KMS, and uses it to decrypt the secret.

The tool is designed for teams that want a lightweight, AWS-native alternative to dedicated secret-management systems. It supports versioning (so you can rotate credentials by creating new versions), encryption context (for audit trails and fine-grained access control via KMS policies), and simple CLI operations (put, get, list). However, the project has been abandoned since 2022 with no active maintenance, so it may not be compatible with current AWS SDK versions or modern Python environments without manual updates.

Use it for:

- Store database passwords and API keys in DynamoDB, encrypted by KMS, for retrieval during application bootstrap.
- Rotate credentials by creating new versions of a secret and updating client code to fetch the latest version.
- Audit credential access by associating encryption context with secrets and reviewing KMS CloudTrail logs.
- Distribute secrets to multiple servers or containers by having them fetch from the same DynamoDB table using shared KMS permissions.
- Manage TLS/SSL certificates and private keys with fine-grained access control via KMS Key Policy conditions.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

CredStash stores and retrieves secrets using AWS KMS for encryption and DynamoDB for storage, providing a simple credential management system for applications and infrastructure.

No—the project is abandoned (last release April 2020, last commit February 2022) and likely incompatible with current AWS SDK and Python versions. For new projects, use AWS Secrets Manager or Parameter Store instead. Only consider it for legacy systems already running CredStash that cannot be migrated.

## Install

pip install credstash
uv add credstash
poetry add credstash

## Installing credstash

Before you install: Low install friction on macOS and Windows; Linux requires build tools and development headers for the cryptography dependency (libssl-dev, libffi-dev, build-essential on Debian/Ubuntu; gcc, libffi-devel, openssl-devel on Fedora/RHEL). Project is abandoned as of 2022, with no releases since April 2020.

License in practice: Licensed under Apache 2.0 (permissive), allowing commercial use, modification, and distribution with minimal restrictions—suitable for most organizational contexts.

Quickstart:

pip install credstash

import credstash

# Requires AWS credentials and KMS key setup
secret = credstash.getSecret(name='myapp.db.prod')

AWS credentials must be configured (environment variables, ~/.aws/credentials, or IAM role); a KMS key named 'credstash' and a DynamoDB table must exist; on Linux, build tools and libssl-dev/libffi-dev headers required before pip install.

Verify before relying:

- Current compatibility with modern versions of boto3 and cryptography, given the project's abandonment in 2022.
- Whether the package works with current AWS API versions and DynamoDB behavior.
- Support status for Python versions beyond those tested during active maintenance.

## Package facts

- License: Apache2 (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: abandoned
- Downloads: 490.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

AWS secret management, KMS credential storage, DynamoDB secrets, credential rotation, encrypted secret distribution, AWS credential management, secret versioning, aws-integration, secret-management, abandoned

[View on SkillFed](https://skillfed.io/packages/credstash) · [View on PyPI](https://pypi.org/project/credstash/)