Skip to content
Audex

Audex

Stop giving your AI agent full cloud access.

Audex wraps any command with temporary, scoped credentials for AWS, GCP, Azure, or HashiCorp Vault. When the command exits, credentials are automatically revoked. Every action is logged.

Terminal window
tryaudex run --allow "s3:GetObject,s3:ListBucket" -- aws s3 ls

One command. Multi-cloud. Scoped access. Auto-revoked.

The Problem

Section titled “The Problem”

AI coding agents (Claude Code, Cursor, Copilot) increasingly need to interact with cloud infrastructure directly. You have three bad options:

ApproachRisk
Give full cloud credentialsOne hallucinated rm from disaster
Give no credentialsAgent can write code but can’t test or deploy
Manually scope IAM rolesTakes hours, nobody maintains them, roles never expire

Audex is the middle ground. Scoped permissions, short-lived credentials, automatic revocation, full audit trail.

Install

Section titled “Install”
Terminal window
# From crates.io
cargo install tryaudex


# From source
cargo install --git https://github.com/Aditya-PS-05/tryaudex


# Or build locally
git clone https://github.com/Aditya-PS-05/tryaudex
cd tryaudex && cargo build --release

Quick Start

Section titled “Quick Start”

1. Set up an IAM role

Section titled “1. Set up an IAM role”

Create an IAM role that Audex can assume. Audex further restricts this role with inline session policies per command.

Terminal window
export AUDEX_ROLE_ARN="arn:aws:iam::123456789:role/AudexAgentRole"

2. Run a command with scoped credentials

Section titled “2. Run a command with scoped credentials”
Terminal window
# Read-only S3 access for 5 minutes
tryaudex run --ttl 5m --allow "s3:GetObject,s3:ListBucket" -- aws s3 ls


# Deploy a Lambda with a budget cap
tryaudex run --ttl 15m --budget 5 \
  --allow "lambda:UpdateFunctionCode,lambda:GetFunction" \
  -- ./deploy.sh


# Let an AI agent work with scoped access
tryaudex run --ttl 30m --allow "s3:GetObject,dynamodb:Query" \
  -- your-agent "analyze the data"

3. Review what happened

Section titled “3. Review what happened”
Terminal window
# List all sessions
tryaudex sessions list


# View audit log for a session
tryaudex audit show a1b2c3d4


# Or just run `tryaudex` for the interactive dashboard
tryaudex

What Audex Does

Section titled “What Audex Does”
  1. You specify allowed actions (--allow "s3:GetObject")
  2. Audex calls your cloud provider’s credential API (AWS STS, GCP IAM Credentials, Azure, or Vault)
  3. Temporary credentials are injected as env vars into the subprocess
  4. When the process exits (or TTL expires), credentials stop working
  5. Every session is logged to an append-only audit trail

The base role/identity’s permissions are the ceiling. The inline session policy further restricts them. The effective permissions are the intersection of both… the inline policy can only narrow, never widen.

Multi-Cloud Support

Section titled “Multi-Cloud Support”

Audex supports AWS, GCP, Azure, and HashiCorp Vault. Use --provider to switch:

Terminal window
# AWS (default)
tryaudex run --provider aws --allow "s3:GetObject" -- aws s3 ls


# GCP
tryaudex run --provider gcp --allow "storage.objects.get" -- gsutil ls


# Azure
tryaudex run --provider azure --allow "Microsoft.Storage/storageAccounts/read" -- az storage account list


# HashiCorp Vault (AWS secrets engine)
tryaudex run --provider vault --allow "s3:GetObject" -- aws s3 ls

See Multi-Cloud for setup instructions for each provider.

Deep Dive

Section titled “Deep Dive”