can't use aws-vault and aws cli within Codex

What version of Codex is running?

codex-cli 0.57.0

What subscription do you have?

Plus

Which model were you using?

_No response_

What platform is your computer?

macOS 26.0.1, Darwin 25.0.0 arm64 arm

What issue are you seeing?

installed via brew.
cannot execute aws-vault within Codex CLI shell:
• Ran aws-vault exec ***-sso -- aws sts get-caller-identity
└ aws-vault: error: exec: Error getting temporary credentials: One or more parameters passed to the function were not valid. (-50)

reply from codex with --debug:
"aws-vault immediately logs:

• it’s using the macOS Keychain backend and the osascript prompt driver
• it parses ~/.aws/config successfully
• then it reports Profile 'default' missing in config file and fails with the same Keychain error (-50) when trying to retrieve credentials.

So the tool never gets as far as opening the SSO session or prompting for credentials—the macOS Keychain call is still failing before any AWS request is made. If you have a custom Keychain setup (e.g., separate login, or you unlocked it earlier in the session), that might explain why it works for you but not from this sandboxed environment.

At this point I can’t reach the account with aws-vault or AWS CLI."

There are no issues with aws-vault itself and its usage in the terminal, or within Claude, for ex.

What steps can reproduce the bug?

any aws cli command after was-vault exec:

codex

aws-vault exec profile -- aws sts get-caller-identity

What is the expected behavior?

aws-vault has the access to macOS Keychain, so codex can use temporary credentials, and use aws cli

Additional information

_No response_