{
  "id": "saml2aws",
  "name": "saml2aws",
  "homepage": "https://github.com/Versent/saml2aws",
  "description": "A command-line tool that converts SAML assertions into AWS credentials.",
  "executables": [
    "saml2aws"
  ],
  "dotfiles": {
    "paths": [
      "~/.saml2aws"
    ],
    "exclude": [],
    "secret": []
  },
  "commands": {
    "format": 1,
    "label": "saml2aws",
    "description": "Log in to a SAML identity provider for temporary AWS credentials, or run a command with them. Provider-specific login flags (Okta, OneLogin, F5 APM) are left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "subcommand": [
      {
        "path": [
          "login"
        ],
        "label": "Log in and fetch credentials",
        "description": "Login to a SAML 2.0 IDP and convert the SAML assertion to an STS token.",
        "source": [
          {
            "id": "help",
            "kind": "help",
            "url": "https://github.com/Versent/saml2aws#usage",
            "revision": "2026-10-27",
            "evidence": "  -a, --idp-account=\"default\"  The name of the configured IDP account. (env: SAML2AWS_IDP_ACCOUNT)\n  -s, --skip-verify            Skip verification of server certificate. (env: SAML2AWS_SKIP_VERIFY)\n      --skip-prompt            Skip prompting for parameters during login.\n      --session-duration=SESSION-DURATION\n      --role=ROLE              The ARN of the role to assume. (env: SAML2AWS_ROLE)\n  login [<flags>]\n    Login to a SAML 2.0 IDP and convert the SAML assertion to an STS token.\n    -p, --profile=PROFILE        The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)\n        --force                  Refresh credentials even if not expired.\n        --credential-process     Enables AWS Credential Process support by outputting credentials to STDOUT in a JSON message.\n"
          }
        ],
        "field": [
          {
            "id": "idp_account",
            "label": "IDP account",
            "type": "string",
            "option": [
              "--idp-account",
              "-a"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "profile",
            "label": "AWS profile",
            "description": "Profile that receives the temporary credentials.",
            "type": "string",
            "option": [
              "--profile",
              "-p"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "role",
            "label": "Role ARN",
            "type": "string",
            "option": [
              "--role"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "session_duration",
            "label": "Session duration (seconds)",
            "type": "integer",
            "option": [
              "--session-duration"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "force",
            "label": "Force refresh",
            "description": "Refresh credentials even if not expired.",
            "type": "boolean",
            "option": [
              "--force"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "skip_prompt",
            "label": "Skip prompts",
            "type": "boolean",
            "option": [
              "--skip-prompt"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "skip_verify",
            "label": "Skip certificate verification",
            "type": "boolean",
            "option": [
              "--skip-verify",
              "-s"
            ],
            "sources": [
              "help"
            ]
          }
        ],
        "task": [
          {
            "id": "login",
            "label": "Log in",
            "fields": [
              "idp_account",
              "profile",
              "role",
              "session_duration",
              "force"
            ]
          },
          {
            "id": "refresh",
            "label": "Force a refresh",
            "set": {
              "force": [
                true
              ]
            },
            "lock": [
              "force"
            ],
            "fields": [
              "idp_account",
              "profile",
              "force",
              "skip_prompt"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "idp_account",
              "profile",
              "role",
              "force"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "session_duration",
              "skip_prompt",
              "skip_verify"
            ]
          }
        ]
      },
      {
        "path": [
          "exec"
        ],
        "label": "Run a command with credentials",
        "description": "Exec the supplied command with env vars from STS token.",
        "source": [
          {
            "id": "help",
            "kind": "help",
            "url": "https://github.com/Versent/saml2aws#usage",
            "revision": "2026-10-27",
            "evidence": "  exec [<flags>] [<command>...]\n    Exec the supplied command with env vars from STS token.\n    -p, --profile=PROFILE      The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)\n        --exec-profile=EXEC-PROFILE\n"
          }
        ],
        "field": [
          {
            "id": "profile",
            "label": "AWS profile",
            "type": "string",
            "option": [
              "--profile",
              "-p"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "exec_profile",
            "label": "Execution profile",
            "description": "Profile used for command execution, e.g. for secondary role assumption.",
            "type": "string",
            "option": [
              "--exec-profile"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "command",
            "label": "Command",
            "type": "string",
            "position": 0,
            "multiple": true,
            "min": 1,
            "sources": [
              "help"
            ]
          }
        ],
        "task": [
          {
            "id": "exec",
            "label": "Run a command",
            "fields": [
              "profile",
              "exec_profile",
              "command"
            ],
            "required": [
              "command"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "profile",
              "exec_profile",
              "command"
            ]
          }
        ]
      },
      {
        "path": [
          "console"
        ],
        "label": "Open the AWS console",
        "description": "Console will open the aws console after logging in.",
        "source": [
          {
            "id": "help",
            "kind": "help",
            "url": "https://github.com/Versent/saml2aws#usage",
            "revision": "2026-10-27",
            "evidence": "  console [<flags>]\n    Console will open the aws console after logging in.\n    -p, --profile=PROFILE      The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)\n        --force                Refresh credentials even if not expired.\n        --link                 Present link to AWS console instead of opening browser\n"
          }
        ],
        "field": [
          {
            "id": "profile",
            "label": "AWS profile",
            "type": "string",
            "option": [
              "--profile",
              "-p"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "force",
            "label": "Force refresh",
            "type": "boolean",
            "option": [
              "--force"
            ],
            "sources": [
              "help"
            ]
          },
          {
            "id": "link",
            "label": "Print link only",
            "description": "Present a link instead of opening the browser.",
            "type": "boolean",
            "option": [
              "--link"
            ],
            "sources": [
              "help"
            ]
          }
        ],
        "task": [
          {
            "id": "console",
            "label": "Open console",
            "fields": [
              "profile",
              "force",
              "link"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "profile",
              "force",
              "link"
            ]
          }
        ]
      }
    ]
  }
}