{
  "id": "aws-sso-cli",
  "name": "AWS SSO CLI",
  "homepage": "https://synfinatic.github.io/aws-sso-cli/",
  "description": "Securely manage AWS API credentials using AWS SSO",
  "executables": [
    "aws-sso"
  ],
  "dotfiles": {
    "paths": [
      "~/.aws-sso/config.yaml",
      "[configHome]/aws-sso/config.yaml"
    ],
    "secret": [
      "~/.aws-sso/",
      "[configHome]/aws-sso/"
    ]
  },
  "commands": {
    "format": 1,
    "label": "AWS SSO CLI",
    "description": "Log in to IAM Identity Center, run commands or open the console with a role's credentials, and list roles. Process, ECS, setup and cache commands are left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "source": [
      {
        "id": "ref",
        "kind": "manual",
        "url": "https://github.com/synfinatic/aws-sso-cli/blob/main/docs/commands.md",
        "revision": "2026-10-27",
        "evidence": "* `--sso <name>`, `-S` -- Specify non-default AWS SSO instance to use (`$AWS_SSO`)\n* `--level <level>`, `-L` -- Change default log level: [error|warn|info|debug|trace]\n"
      }
    ],
    "field": [
      {
        "id": "sso",
        "label": "SSO instance",
        "description": "Name of a non-default SSO instance.",
        "type": "string",
        "option": [
          "--sso",
          "-S"
        ],
        "sources": [
          "ref"
        ]
      },
      {
        "id": "level",
        "label": "Log level",
        "type": "enum",
        "option": [
          "--level",
          "-L"
        ],
        "choices": [
          {
            "value": "error",
            "label": "Error"
          },
          {
            "value": "warn",
            "label": "Warn"
          },
          {
            "value": "info",
            "label": "Info"
          },
          {
            "value": "debug",
            "label": "Debug"
          },
          {
            "value": "trace",
            "label": "Trace"
          }
        ],
        "sources": [
          "ref"
        ]
      }
    ],
    "group": [
      {
        "id": "basic",
        "label": "Basic",
        "fields": [
          "sso",
          "level"
        ]
      }
    ],
    "subcommand": [
      {
        "path": [
          "login"
        ],
        "label": "Log in",
        "source": [
          {
            "id": "ref",
            "kind": "manual",
            "url": "https://github.com/synfinatic/aws-sso-cli/blob/main/docs/commands.md",
            "revision": "2026-10-27",
            "evidence": "* `--url-action`, `-u` -- How to handle URLs for your SSO provider\n* `--threads <int>` -- Number of threads to use with AWS (default: 5)\n* `--force`, `-f` -- End the current SSO session and start a new one, resetting the\n"
          }
        ],
        "field": [
          {
            "id": "url_action",
            "label": "URL action",
            "description": "How to handle the SSO login URL.",
            "type": "string",
            "option": [
              "--url-action",
              "-u"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "threads",
            "label": "Threads",
            "type": "integer",
            "option": [
              "--threads"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "force",
            "label": "Force a new session",
            "description": "Ends the current SSO session and starts a new one.",
            "type": "boolean",
            "option": [
              "--force",
              "-f"
            ],
            "sources": [
              "ref"
            ]
          }
        ],
        "task": [
          {
            "id": "login",
            "label": "Log in",
            "fields": [
              "url_action",
              "force"
            ],
            "required": []
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "url_action",
              "force",
              "threads"
            ]
          }
        ]
      },
      {
        "path": [
          "exec"
        ],
        "label": "Run a command with a role",
        "source": [
          {
            "id": "ref",
            "kind": "manual",
            "url": "https://github.com/synfinatic/aws-sso-cli/blob/main/docs/commands.md",
            "revision": "2026-10-27",
            "evidence": "* `--arn <arn>`, `-a` -- ARN of role to assume (`$AWS_SSO_ROLE_ARN`)\n* `--account <account>`, `-A` -- AWS AccountID of role to assume (`$AWS_SSO_ACCOUNT_ID`)\n* `--role <role>`, `-R` -- Name of AWS Role to assume (`$AWS_SSO_ROLE_NAME`)\n* `--profile <profile>`, `-p` -- Name of AWS Profile to assume\n* `--no-region` -- Do not set the [AWS_DEFAULT_REGION](config.md#defaultregion) from config.yaml\n* `--overwrite-env`, `-O` -- Force overwriting existing `AWS_*` environment variables\n* `--sts-refresh` -- Force refresh of STS Token Credentials\nArguments: `[<command>] [<args> ...]`\n"
          }
        ],
        "field": [
          {
            "id": "profile",
            "label": "Profile",
            "type": "string",
            "option": [
              "--profile",
              "-p"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "arn",
            "label": "Role ARN",
            "type": "string",
            "option": [
              "--arn",
              "-a"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "account",
            "label": "Account ID",
            "type": "string",
            "option": [
              "--account",
              "-A"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "role",
            "label": "Role name",
            "type": "string",
            "option": [
              "--role",
              "-R"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "no_region",
            "label": "Do not set default region",
            "type": "boolean",
            "option": [
              "--no-region"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "overwrite_env",
            "label": "Overwrite existing AWS_* variables",
            "type": "boolean",
            "option": [
              "--overwrite-env",
              "-O"
            ],
            "effect": "overwrite",
            "sources": [
              "ref"
            ]
          },
          {
            "id": "sts_refresh",
            "label": "Refresh STS credentials",
            "type": "boolean",
            "option": [
              "--sts-refresh"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "command",
            "label": "Command and arguments",
            "description": "Leave empty to start an interactive shell.",
            "type": "string",
            "position": 0,
            "multiple": true,
            "sources": [
              "ref"
            ]
          }
        ],
        "task": [
          {
            "id": "profile_shell",
            "label": "Shell with a profile",
            "fields": [
              "profile",
              "command"
            ],
            "required": [
              "profile"
            ]
          },
          {
            "id": "role_command",
            "label": "Command with an account and role",
            "fields": [
              "account",
              "role",
              "command"
            ],
            "required": [
              "account",
              "role"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "profile",
              "account",
              "role",
              "command"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "arn",
              "no_region",
              "overwrite_env",
              "sts_refresh"
            ]
          }
        ]
      },
      {
        "path": [
          "console"
        ],
        "label": "Open the AWS console",
        "source": [
          {
            "id": "ref",
            "kind": "manual",
            "url": "https://github.com/synfinatic/aws-sso-cli/blob/main/docs/commands.md",
            "revision": "2026-10-27",
            "evidence": "* `--duration <minutes>`, `-d` -- AWS Session duration in minutes (default 60)\n* `--prompt`, `-P` -- Force interactive prompt to select role\n* `--region <region>`, `-r` -- Specify the `$AWS_DEFAULT_REGION` to use\n* `--arn <arn>`, `-a` -- ARN of role to assume (`$AWS_SSO_ROLE_ARN`)\n* `--account <account>`, `-A` -- AWS AccountID of role to assume (`$AWS_SSO_ACCOUNT_ID`)\n* `--role <role>`, `-R` -- Name of AWS Role to assume (requires `--account`) (`$AWS_SSO_ROLE_NAME`)\n* `--profile <profile>`, `-p` -- Name of AWS Profile to assume\n* `--url-action`, `-u` -- How to handle URLs for your SSO provider\n"
          }
        ],
        "field": [
          {
            "id": "profile",
            "label": "Profile",
            "type": "string",
            "option": [
              "--profile",
              "-p"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "prompt",
            "label": "Prompt to select a role",
            "type": "boolean",
            "option": [
              "--prompt",
              "-P"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "account",
            "label": "Account ID",
            "type": "string",
            "option": [
              "--account",
              "-A"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "role",
            "label": "Role name",
            "description": "Requires an account ID.",
            "type": "string",
            "option": [
              "--role",
              "-R"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "arn",
            "label": "Role ARN",
            "type": "string",
            "option": [
              "--arn",
              "-a"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "region",
            "label": "Region",
            "type": "string",
            "option": [
              "--region",
              "-r"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "duration",
            "label": "Session duration (minutes)",
            "type": "integer",
            "option": [
              "--duration",
              "-d"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "url_action",
            "label": "URL action",
            "description": "What to do with the generated URL.",
            "type": "string",
            "option": [
              "--url-action",
              "-u"
            ],
            "sources": [
              "ref"
            ]
          }
        ],
        "task": [
          {
            "id": "profile_console",
            "label": "Console for a profile",
            "fields": [
              "profile",
              "region",
              "duration",
              "url_action"
            ],
            "required": [
              "profile"
            ]
          },
          {
            "id": "pick_console",
            "label": "Console, choose a role interactively",
            "set": {
              "prompt": [
                true
              ]
            },
            "fields": [
              "prompt",
              "region",
              "url_action"
            ],
            "required": []
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "profile",
              "prompt",
              "region",
              "url_action"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "account",
              "role",
              "arn",
              "duration"
            ]
          }
        ]
      },
      {
        "path": [
          "list"
        ],
        "label": "List roles",
        "source": [
          {
            "id": "ref",
            "kind": "manual",
            "url": "https://github.com/synfinatic/aws-sso-cli/blob/main/docs/commands.md",
            "revision": "2026-10-27",
            "evidence": "* `--list-fields`, `-f` -- List the available fields to print\n* `--prefix <FieldName>=<Prefix>`, `-P` -- Filter results by the given field\n* `--csv` -- Generate results in CSV format\n* `--sort <FieldName>`, `-s` -- Sort results by the provided field name\n* `--reverse` -- Reverse the sort order\nArguments: `[<field> ...]`\n"
          }
        ],
        "field": [
          {
            "id": "fields",
            "label": "Fields to show",
            "description": "Field names such as AccountIdPad, AccountAlias, RoleName, Expires.",
            "type": "string",
            "position": 0,
            "multiple": true,
            "sources": [
              "ref"
            ]
          },
          {
            "id": "list_fields",
            "label": "List available fields",
            "type": "boolean",
            "option": [
              "--list-fields",
              "-f"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "prefix",
            "label": "Filter by field prefix",
            "description": "FieldName=Prefix",
            "type": "string",
            "option": [
              "--prefix",
              "-P"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "csv",
            "label": "CSV output",
            "type": "boolean",
            "option": [
              "--csv"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "sort",
            "label": "Sort by field",
            "type": "string",
            "option": [
              "--sort",
              "-s"
            ],
            "sources": [
              "ref"
            ]
          },
          {
            "id": "reverse",
            "label": "Reverse sort",
            "type": "boolean",
            "option": [
              "--reverse"
            ],
            "sources": [
              "ref"
            ]
          }
        ],
        "task": [
          {
            "id": "list",
            "label": "List roles",
            "fields": [
              "fields",
              "sort",
              "reverse"
            ],
            "required": []
          },
          {
            "id": "csv",
            "label": "Export roles as CSV",
            "set": {
              "csv": [
                true
              ]
            },
            "fields": [
              "fields",
              "csv",
              "prefix",
              "sort"
            ],
            "required": []
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "fields",
              "sort",
              "reverse",
              "csv"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "prefix",
              "list_fields"
            ]
          }
        ]
      }
    ]
  }
}