{
  "id": "okta-awscli",
  "name": "okta-awscli",
  "homepage": "https://github.com/jmhale/okta-awscli",
  "executables": [
    "okta-awscli"
  ],
  "dotfiles": {
    "paths": [
      "~/.okta-aws"
    ],
    "exclude": [],
    "secret": [],
    "secret_paths": [
      {
        "file": "~/.okta-aws",
        "match": {
          "prefix": [
            "password"
          ]
        }
      }
    ]
  },
  "commands": {
    "format": 1,
    "label": "Get AWS credentials via Okta",
    "description": "Authenticate to Okta and fetch temporary AWS STS credentials, optionally running an awscli command. Passwords are deliberately not offered as a field.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": true
    },
    "source": [
      {
        "id": "readme",
        "kind": "help",
        "url": "https://github.com/jmhale/okta-awscli/blob/main/README.md",
        "revision": "main",
        "evidence": "`okta-awscli --profile <aws_profile> <awscli action> <awscli arguments>`\n- `--profile` or `-p` Sets your temporary credentials to a profile in `.aws/credentials`. If omitted and not configured in `~/.okta-aws`, credentials will output to console.\n- `--username` or `-U` Okta username.\n- `--force` or `-f` Ignores result of STS credentials validation and gets new credentials from AWS. Used in conjunction with `--profile`.\n- `--verbose` or `-v` More verbose output.\n- `--debug` or `-d` Very verbose output. Useful for debugging.\n- `--cache` or `-c` Cache the acquired credentials to ~/.okta-credentials.cache (only if --profile is unspecified)\n- `--okta-profile` or `-o` Use a Okta profile, other than `default` in `.okta-aws`. Useful for multiple Okta tenants.\n- `--token` or `-t` Pass in the TOTP token from your authenticator\n- `--refresh-role` or `-r` Refresh the AWS role to be assumed.\n- `--lookup` or `-l` Lookup and return the AWS Account Alias for each role, instead of returning the raw ARN.\n- `--config` Add/Create new Okta profile configuration.\n"
      }
    ],
    "field": [
      {
        "id": "profile",
        "label": "AWS profile to write",
        "description": "Without a profile, credentials are printed to the console.",
        "type": "string",
        "option": [
          "--profile",
          "-p"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "okta_profile",
        "label": "Okta profile",
        "type": "string",
        "option": [
          "--okta-profile",
          "-o"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "username",
        "label": "Okta username",
        "type": "string",
        "option": [
          "--username",
          "-U"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "token",
        "label": "TOTP token",
        "type": "string",
        "option": [
          "--token",
          "-t"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "force",
        "label": "Force new credentials",
        "type": "boolean",
        "option": [
          "--force",
          "-f"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "refresh_role",
        "label": "Refresh the AWS role",
        "type": "boolean",
        "option": [
          "--refresh-role",
          "-r"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "lookup",
        "label": "Show account aliases",
        "type": "boolean",
        "option": [
          "--lookup",
          "-l"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "cache",
        "label": "Cache credentials",
        "type": "boolean",
        "option": [
          "--cache",
          "-c"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "verbose",
        "label": "Verbose output",
        "type": "boolean",
        "option": [
          "--verbose",
          "-v"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "debug",
        "label": "Debug output",
        "type": "boolean",
        "option": [
          "--debug",
          "-d"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "config",
        "label": "Create an Okta profile",
        "type": "boolean",
        "option": [
          "--config"
        ],
        "sources": [
          "readme"
        ]
      },
      {
        "id": "awscli_args",
        "label": "awscli command",
        "description": "Optional awscli action and arguments to run with the credentials, e.g. iam list-users.",
        "type": "string",
        "position": 0,
        "multiple": true,
        "sources": [
          "readme"
        ]
      }
    ],
    "task": [
      {
        "id": "login",
        "label": "Write credentials to a profile",
        "fields": [
          "profile",
          "okta_profile",
          "force",
          "token"
        ],
        "required": [
          "profile"
        ]
      },
      {
        "id": "configure",
        "label": "Configure an Okta profile",
        "fields": [
          "config"
        ],
        "required": [
          "config"
        ],
        "set": {
          "config": [
            true
          ]
        }
      }
    ],
    "group": [
      {
        "id": "basic",
        "label": "Basic",
        "fields": [
          "profile",
          "okta_profile",
          "username",
          "token",
          "awscli_args"
        ]
      },
      {
        "id": "advanced",
        "label": "Advanced",
        "fields": [
          "force",
          "refresh_role",
          "lookup",
          "cache",
          "verbose",
          "debug",
          "config"
        ]
      }
    ]
  }
}