id          = "gimme-aws-creds"
name        = "gimme-aws-creds"
homepage    = "https://github.com/Nike-Inc/gimme-aws-creds"
description = "CLI to retrieve AWS credentials from Okta."
executables      = ["gimme-aws-creds"]

[dotfiles]

# The project's README documents ~/.okta_aws_login_config as the default
# configuration file (and OKTA_CONFIG as its override). It contains Okta
# settings and may contain a device token, so the complete file is secret.
# https://github.com/Nike-Inc/gimme-aws-creds#configuration
paths  = []
secret = ["~/.okta_aws_login_config"]

[commands]
format = 1
label = "Get AWS credentials"
description = "Fetch temporary AWS credentials through Okta and print them as shell exports or JSON. Okta configuration setup, FIDO setup, device registration and Alibaba Cloud options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "help"
kind = "help"
url = "https://github.com/Nike-Inc/gimme-aws-creds/blob/master/gimme_aws_creds/config.py"
revision = "master 2026-10-27"
evidence = """
parser.add_argument('--username', '-u', help="The username to use when logging into Okta.")
parser.add_argument('--output-format', '-o', choices=['export', 'json'], help='Output credentials as either list of shell exports or lines of structured JSON.')
parser.add_argument('--profile', '-p', help='If set, the specified configuration profile will be used instead of the default.')
parser.add_argument('--roles', help='If set, the specified role will be used instead of the aws_rolename in the profile, can be specified as a comma separated list')
parser.add_argument('--resolve', '-r', action='store_true', help='If set, perfom alias resolution.')
parser.add_argument('--insecure', '-k', action='store_true', help='Allow connections to SSL sites without cert verification.')
parser.add_argument('--mfa-code', help="The MFA verification code to be used with SMS or TOTP authentication methods.")
parser.add_argument('--remember-device', '-m', action='store_true', help="The MFA device will be remembered by Okta service for a limited time")
parser.add_argument('--action-list-profiles', '--list-profiles', action='store_true', help='List all the profiles under .okta_aws_login_config')
parser.add_argument('--action-list-roles', action='store_true', help='List all the roles in the selected profile')
parser.add_argument('--action-store-json-creds', action='store_true', help='Read credentials from stdin (in json format) and store them in ~/.aws/credentials file')
parser.add_argument('--open-browser', action='store_true', help='Automatically open a webbrowser for device authorization (Okta Identity Engine only)')
parser.add_argument('--debug', action='store_true', help='Enable debug logging to show API request and response data')
"""

[[commands.field]]
id = "profile"
label = "Configuration profile"
type = "string"
option = ["--profile", "-p"]
sources = ["help"]

[[commands.field]]
id = "username"
label = "Okta username"
type = "string"
option = ["--username", "-u"]
sources = ["help"]

[[commands.field]]
id = "output_format"
label = "Output format"
type = "enum"
option = ["--output-format", "-o"]
choices = [{ value = "export", label = "Shell exports" }, { value = "json", label = "JSON lines" }]
sources = ["help"]

[[commands.field]]
id = "roles"
label = "Role(s)"
description = "Comma-separated role ARNs, or a /regex/ pattern."
type = "string"
option = ["--roles"]
sources = ["help"]

[[commands.field]]
id = "resolve"
label = "Resolve account aliases"
type = "boolean"
option = ["--resolve", "-r"]
sources = ["help"]

[[commands.field]]
id = "mfa_code"
label = "MFA code"
type = "string"
option = ["--mfa-code"]
sources = ["help"]

[[commands.field]]
id = "remember_device"
label = "Remember MFA device"
type = "boolean"
option = ["--remember-device", "-m"]
sources = ["help"]

[[commands.field]]
id = "open_browser"
label = "Open browser for device authorization"
type = "boolean"
option = ["--open-browser"]
sources = ["help"]

[[commands.field]]
id = "insecure"
label = "Skip SSL certificate verification"
type = "boolean"
option = ["--insecure", "-k"]
sources = ["help"]

[[commands.field]]
id = "debug"
label = "Debug logging"
type = "boolean"
option = ["--debug"]
sources = ["help"]

[[commands.field]]
id = "list_profiles"
label = "List profiles"
type = "boolean"
option = ["--action-list-profiles"]
sources = ["help"]

[[commands.field]]
id = "list_roles"
label = "List roles"
type = "boolean"
option = ["--action-list-roles"]
sources = ["help"]

[[commands.task]]
id = "creds"
label = "Get credentials"
fields = ["profile", "output_format", "roles", "remember_device"]
required = []

[[commands.task]]
id = "list_roles"
label = "List roles"
fields = ["profile", "list_roles"]
required = ["list_roles"]
set = { list_roles = [true] }
lock = ["list_roles"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["profile", "username", "output_format", "roles", "resolve", "mfa_code", "remember_device", "list_profiles", "list_roles"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["open_browser", "insecure", "debug"]