elhaz

What is elhaz?

elhaz is a local daemon-backed AWS temporary credential broker, exposed over a Unix socket and controlled via CLI.

Instead of a locally hosted HTTP metadata emulation service (ECS), which is less secure and requires multiple processes for each assumed RoleArn, elhaz runs a single process and serves automatically refreshed temporary AWS credentials on demand.

elhaz caches AWS sessions for however long the daemon is kept alive (or sessions are removed by command), which eliminates redundant session creations and STS calls.

Unix-socket IPC is lightweight and gives a tighter local boundary than HTTP, avoids exposing local credential endpoints over TCP, and allows temporary credentials to live in memory rather than at rest on disk.

Crucially, because elhaz uses boto3-refresh-session as its core dependency for refreshing temporary AWS security credentials, which in turn depends on botocore, elhaz supports IAM Identity Center (SSO) using the AWS CLI.

elhaz makes multi-role local AWS workflows cleaner by combining brokered access, in-memory caching, IAM Identity Center (SSO) support, and host-local IPC into one model.

elhaz was authored by Mike Letts and is maintained by 61418.

Installation

With uv:

uv tool install elhaz

With pipx:

pipx install elhaz

Usage

To get started with using elhaz, check the quickstart guide.

To learn critical concepts for using elhaz, check the concepts section of the docs.

For technical details, check the CLI docs.

Recognition and Testimonials

elhaz was presented at the fwd:cloudsec North America 2026 conference.

elhaz has been featured by TL;DR Sec newsletter and AWS Security Digest.

In this blog post, EngSecLabs cleverly mounts the Unix socket managed by elhaz to a Docker container in order to sandbox an AI agent.

License

elhaz is licensed by the Mozilla Public License 2.0 (MPL-2.0).

Contributing

Refer to the contributing guidelines.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

elhaz-0.5.6.tar.gz (133.3 kB view details)

Uploaded Jul 5, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

elhaz-0.5.6-py3-none-any.whl (39.8 kB view details)

Uploaded Jul 5, 2026 Python 3

File details

Details for the file elhaz-0.5.6.tar.gz.

File metadata

Download URL: elhaz-0.5.6.tar.gz
Upload date: Jul 5, 2026
Size: 133.3 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for elhaz-0.5.6.tar.gz
Algorithm	Hash digest
SHA256	`08535d30aa4719ce87e73922939b64871b7ab2fb9290f5c52d0d194a3187874b`
MD5	`24970c647565a7dab1d6781a4d8512e7`
BLAKE2b-256	`008ae029042452a0260b032572ff93b21dcd8351c6a68967b3a43a5254b82281`

See more details on using hashes here.

Provenance

The following attestation bundles were made for elhaz-0.5.6.tar.gz:

Publisher: push.yml on 61418/elhaz

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: elhaz-0.5.6.tar.gz
- Subject digest: 08535d30aa4719ce87e73922939b64871b7ab2fb9290f5c52d0d194a3187874b
- Sigstore transparency entry: 2074039793
- Sigstore integration time: Jul 5, 2026
Source repository:
- Permalink: 61418/elhaz@176b56c51a570b9dccd85b69cd97f13096c8eee5
- Branch / Tag: refs/heads/main
- Owner: https://github.com/61418
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: push.yml@176b56c51a570b9dccd85b69cd97f13096c8eee5
- Trigger Event: push