Leapp Documentation

Leapp is a cross-platform desktop application built on Electron designed for managing and securing cloud access in multi-account environments. It provides a safe way to generate and manage cloud credentials across macOS, Windows, and Linux.

Key capabilities include:

• One-click cloud credential generation
• Secure local storage: Data is encrypted and stored in the OS System Vault.
• Automated credential management: Supports short-lived credential rotation (e.g., for AWS) and automatic provisioning of sessions from AWS Single Sign-on.
• Multi-account browser support: Extensions for Firefox and Chrome allow opening multiple AWS consoles from different accounts simultaneously.
• CLI Management: Full management capabilities via the Leapp CLI.
• Extensibility: Users can create custom plugins using a provided template.

Credential Process is an AWS configuration option used to instruct the AWS CLI and SDKs to execute an external command to generate valid credentials on the fly.

Unlike the standard credential file method where credentials are written in plain text to ~/.aws/credentials, Credential Process generates credentials that are printed to stdout and consumed only when needed. This ensures that no sensitive credentials are ever written to disk, reducing the security risk of credential exposure on your machine.

Leapp uses a Zero-Knowledge architecture for the PRO and TEAM versions to allow users to persist their configuration online without Leapp being able to access their secrets.

In this model, the user maintains complete control over the encryption keys. This ensures that the client provides encrypted data to the server, but the server itself never has access to or knowledge of the underlying plaintext passwords or sensitive information. This implementation is based on the same principles used by services like Bitwarden.

An AWS IAM User session in Leapp represents an AWS entity (person or application) defined by a name and long-term credentials.

Key Security Behavior: Leapp does not store your long-term credentials in configuration files. Instead, it uses the provided ACCESS KEY ID and SECRET ACCESS KEY to automatically generate and refresh a set of short-term credentials. This minimizes the risk of long-term credential exposure.

The Session class represents a specific connection state in Leapp. All sessions share a set of mandatory variables used for state management and identification.

Leapp secures sensitive information (such as cloud environment credentials) by storing them in your workstation's native System Vault rather than in plain text files. This leverages the operating system's integrated encryption.

To access these secrets, the system uses the Keytar interface. Every secret is stored in the vault under the service name Leapp. To identify specific secrets, look at the description field of the entry in your system vault; the description contains the underlying name Leapp uses to retrieve that specific secret.

An IAM Chained Role allows you to access services in another AWS account through a main session via a trust relationship.

Key behaviors:

• Leapp default duration: 1 hour (this is the default behavior when the DurationSeconds parameter is not passed).

When using assumeRoleWithSAML, Leapp uses the AssumeRoleWithSAMLResponse API to create temporary security credentials.

Key behaviors:

• Leapp default duration: 1 hour.
• Customization: You can specify a DurationSeconds parameter between 900 seconds (15 minutes) and the maximum session duration allowed by the role (which can range from 1 to 12 hours). The session lasts for the specified duration or until the SAML SessionNotOnOrAfter value, whichever is shorter.
• Storage: Generated credentials for this method are not cached in the keychain.