{
  "id": "okta-aws-cli",
  "name": "Okta AWS CLI",
  "homepage": "https://github.com/okta/okta-aws-cli",
  "description": "A command-line tool for authenticating to AWS through Okta.",
  "executables": [
    "okta-aws-cli"
  ],
  "dotfiles": {
    "paths": [],
    "secret": [
      "~/.okta/okta.yaml"
    ],
    "side_effect": false
  },
  "commands": {
    "format": 1,
    "label": "Get AWS credentials via Okta",
    "description": "Human web (device authorization) flow. Other commands (m2m, direct), private keys and passwords are outside this form.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": false,
      "short_bundles": false
    },
    "source": [
      {
        "id": "readme",
        "kind": "help",
        "url": "https://github.com/okta/okta-aws-cli/blob/master/README.md",
        "revision": "master",
        "evidence": "$ okta-aws-cli web --oidc-client-id 0oabc --aws-acct-fed-app-id 0oaxy --org-domain my-org.okta.com\n| AWS Region (**optional**) | ... | `--aws-region [value]` | `OKTA_AWSCLI_AWS_REGION` |\n| Okta Org Domain (**required**) | ... | `--org-domain [value]` | `OKTA_AWSCLI_ORG_DOMAIN` |\n| OIDC Client ID (**required**) | ... | `--oidc-client-id [value]` | `OKTA_AWSCLI_OIDC_CLIENT_ID` |\n| AWS IAM Role ARN | ... | `--aws-iam-role [value]` | `OKTA_AWSCLI_IAM_ROLE` |\n| AWS Session Duration | The lifetime, in seconds, of the AWS credentials. Must be between 60 and 43200. | `--aws-session-duration [value]` | `OKTA_AWSCLI_SESSION_DURATION` |\n| Output format | Default is `env-var`. Options: `env-var` for output to environment variables, `aws-credentials` for output to AWS credentials file, `process-credentials` for credentials as JSON, or `noop` for no output which can be useful with `--exec` | `--format [value]` | `OKTA_AWSCLI_FORMAT` |\n| Profile | Default is `default` | `--profile [value]` | `OKTA_AWSCLI_PROFILE` |\n| Cache Okta access token ... | `true` if flag is present | `--cache-access-token` | `OKTA_AWSCLI_CACHE_ACCESS_TOKEN=true` |\n| (Over)write the given profile to the AWS credentials file. WARNING: When enabled, overwriting can inadvertently remove dangling comments and extraneous formatting from the creds file. | `true` if flag is present | `--write-aws-credentials` | `OKTA_AWSCLI_WRITE_AWS_CREDENTIALS=true` |\n| Print operational information to the screen for debugging purposes | `true` if flag is present | `--debug` | `OKTA_AWSCLI_DEBUG=true` |\n| Okta AWS Account Federation integration app ID | ... | `--aws-acct-fed-app-id [value]` | `OKTA_AWSCLI_AWS_ACCOUNT_FEDERATION_APP_ID` |\n| Display QR Code | `true` if flag is present | `--qr-code` | `OKTA_AWSCLI_QR_CODE=true` |\n"
      }
    ],
    "field": [
      {
        "id": "org_domain",
        "label": "Okta org domain",
        "description": "For example my-org.okta.com.",
        "type": "string",
        "option": [
          "--org-domain"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "oidc_client_id",
        "label": "OIDC client ID",
        "type": "string",
        "option": [
          "--oidc-client-id"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "aws_acct_fed_app_id",
        "label": "AWS Account Federation app ID",
        "type": "string",
        "option": [
          "--aws-acct-fed-app-id"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "aws_iam_role",
        "label": "Preferred IAM role ARN",
        "type": "string",
        "option": [
          "--aws-iam-role"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "aws_region",
        "label": "AWS region",
        "type": "string",
        "option": [
          "--aws-region"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "session_duration",
        "label": "Session duration (seconds)",
        "description": "Between 60 and 43200.",
        "type": "integer",
        "option": [
          "--aws-session-duration"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "format",
        "label": "Output format",
        "type": "enum",
        "option": [
          "--format"
        ],
        "choices": [
          {
            "value": "env-var",
            "label": "Environment variables"
          },
          {
            "value": "aws-credentials",
            "label": "AWS credentials file"
          },
          {
            "value": "process-credentials",
            "label": "Process credentials JSON"
          },
          {
            "value": "noop",
            "label": "No output"
          }
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "profile",
        "label": "Profile name",
        "type": "string",
        "option": [
          "--profile"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "write_aws_credentials",
        "label": "Write to AWS credentials file",
        "description": "Overwriting can remove comments and formatting from the credentials file.",
        "type": "boolean",
        "option": [
          "--write-aws-credentials"
        ],
        "effect": "overwrite",
        "sources": [
          "readme"
        ]
      },
      {
        "id": "cache_access_token",
        "label": "Cache Okta access token",
        "type": "boolean",
        "option": [
          "--cache-access-token"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "qr_code",
        "label": "Display QR code",
        "type": "boolean",
        "option": [
          "--qr-code"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "debug",
        "label": "Debug output",
        "type": "boolean",
        "option": [
          "--debug"
        ],
        "sources": [
          "readme"
        ]
      }
    ],
    "task": [
      {
        "id": "web_login",
        "label": "Web login",
        "fields": [
          "org_domain",
          "oidc_client_id",
          "aws_acct_fed_app_id",
          "aws_iam_role"
        ],
        "required": [
          "org_domain",
          "oidc_client_id"
        ]
      },
      {
        "id": "save_profile",
        "label": "Save to credentials file",
        "fields": [
          "org_domain",
          "oidc_client_id",
          "aws_acct_fed_app_id",
          "profile",
          "write_aws_credentials",
          "format"
        ],
        "required": [
          "org_domain",
          "oidc_client_id",
          "profile"
        ],
        "set": {
          "write_aws_credentials": [
            true
          ],
          "format": [
            "aws-credentials"
          ]
        }
      }
    ],
    "group": [
      {
        "id": "basic",
        "label": "Basic",
        "fields": [
          "org_domain",
          "oidc_client_id",
          "aws_acct_fed_app_id",
          "aws_iam_role",
          "profile"
        ]
      },
      {
        "id": "advanced",
        "label": "Advanced",
        "fields": [
          "aws_region",
          "session_duration",
          "format",
          "write_aws_credentials",
          "cache_access_token",
          "qr_code",
          "debug"
        ]
      }
    ]
  }
}