Reference
Files & locations
Frost touches five files. Four of them are yours, shared with the AWS CLI and kubectl; one is its own.
Files Frost writes for you
~/.aws/config
The AWS CLI and SDK configuration file, shared with everything else on
your machine that talks to AWS. Frost merges its generated profiles into
it and leaves everything else alone. Each profile it owns carries a
# frost:managed comment.
How the merge works →
~/.aws/sso/cache/<hash>.json
The SSO token cache the AWS CLI and the AWS SDKs read. The filename is a
SHA-1 of your start URL — the same scheme the AWS CLI uses — and the file
holds the start URL, region, access token and expiry. This is the file
that makes aws --profile … work without a separate
aws sso login, and it is rewritten on every refresh. It
holds a live credential, so it is always written with owner-only
permissions (0600) — even when it replaces a more permissive
file left by an older version.
~/.kube/config
Your kubeconfig. Frost replaces the cluster, user and context entries matching the EKS clusters it discovered, and keeps everything else — including your current context. The file is re-serialized as YAML, so comments in it are not preserved. EKS discovery →
~/.aws/config and ~/.kube/config are yours,
so Frost keeps the permissions you gave them and leaves a symlinked
file a symlink; it only chooses 0600 when it has to create
the file itself. Every write is atomic, so an interrupted refresh
cannot leave one of them half-written.
Security & privacy →
Files that belong to Frost
The configuration file
| Platform | Path |
|---|---|
| macOS | ~/Library/Application Support/Frost/config.json |
| Windows | %AppData%\Frost\config.json |
| Linux | ~/.config/Frost/config.json |
Holds everything Frost knows:
- your settings — start URL, region, authentication mode, login page, hotkey, retention;
- the current access token and its expiry — the token encrypted with the operating system's credential store;
- the registered OAuth client id, and its secret, also encrypted;
- the accounts, profiles and clusters found on the last refresh;
- the run history.
Always written with owner-only permissions (0600) — it holds
the access token. Deleting it resets Frost entirely, without touching the
AWS or kubectl files above.
Security & privacy →
Log files
| Platform | Directory |
|---|---|
| macOS | ~/Library/Logs/Frost/ |
| Windows | %AppData%\Frost\logs\ |
| Linux | ~/.config/Frost/logs/ |
One file per local day, main-YYYY-MM-DD.log, at debug level,
with owner-only permissions (0600). Deleted automatically once they pass the
retention period set on the Privacy
page. Activity & logs →
The application itself
| Platform | Location |
|---|---|
| macOS | /Applications/Frost.app (wherever you put it) |
| Windows | %LocalAppData%\Frost\app-<version>\, installed per user by Squirrel |
| Linux | Wherever you unpacked the zip |
The bundled IAM authenticator lives
inside this directory, under resources/, and its path is
what Frost writes into your kubeconfig.
Environment variables
| Variable | Effect |
|---|---|
AWS_IAM_AUTHENTICATOR_PATH |
Use this authenticator binary in kubeconfig entries instead of the bundled one. Details → |
Windows paths
The AWS and kubectl files sit under your user profile:
%UserProfile%\.aws\config,
%UserProfile%\.aws\sso\cache\ and
%UserProfile%\.kube\config — exactly where the AWS CLI and
kubectl look for them.
Uninstalling
- Quit Frost from the tray menu.
- Remove the application — delete
Frost.app, use Add or remove programs on Windows, or delete the unpacked directory on Linux. - Optionally delete the configuration file and log directory listed above.
- Optionally remove the
[profile …]sections marked# frost:managedfrom~/.aws/config, the token cache file, and the contexts in~/.kube/config.
Nothing Frost writes is required for the AWS CLI or kubectl
to keep working; the profiles simply stop being refreshed.