id       = "granted"
name     = "Granted"
homepage = "https://docs.granted.dev"
executables   = ["assume", "granted"]

[dotfiles]

# The project describes itself as "The easiest way to access AWS" in its
# official repository; description is intentionally omitted because the docs
# page is the canonical homepage here.

# Granted's official configuration page identifies `$HOME/.granted` as its
# Unix configuration folder and its config package/source names the file
# `config`; the frecency file in the same folder is runtime cache.
# https://docs.granted.dev/configuration/
# https://pkg.go.dev/github.com/fwdcloudsec/granted/pkg/config
paths = ["~/.granted/config"]
exclude = ["~/.granted/aws_profiles_frecency"]

# SSO tokens are stored in the OS keychain, not in this TOML configuration
# file; `ExportCredsToAWS` only controls whether another AWS file is written.
secret = []

side_effect = false

[commands]
format = 1
label = "Assume an AWS role"
description = "Assume an AWS profile with Granted's assume, optionally opening the AWS console. It prints shell exports through the assume wrapper, so run it in a shell where Granted is set up. SSO flags, credential export and access-request options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.source]]
id = "docs"
kind = "manual"
url = "https://docs.granted.dev/usage/console"
revision = "2026-10-27"
evidence = '''
assume <PROFILE_NAME>
assume -c role-a
--console or -c
--region or -r
assume -c -r ap-southeast-1 role-a
--service or -s
assume -s iam
--console-destination or -cd
--active-role or -ar
To return the URL to stdout instead of launching a browser, use the --url flag.
--duration or -d
'''

[[commands.field]]
id = "profile"
label = "AWS profile"
description = "Profile name from ~/.aws/config. Leave empty to pick one interactively."
type = "string"
position = 0
sources = ["docs"]

[[commands.field]]
id = "console"
label = "Open the AWS console"
type = "boolean"
option = ["--console", "-c"]
sources = ["docs"]

[[commands.field]]
id = "service"
label = "Console service"
description = "Open the console at a specific service, for example iam or cfn."
type = "string"
option = ["--service", "-s"]
sources = ["docs"]

[[commands.field]]
id = "region"
label = "Region"
type = "string"
option = ["--region", "-r"]
sources = ["docs"]

[[commands.field]]
id = "console_destination"
label = "Console destination URL"
type = "url"
option = ["--console-destination", "-cd"]
sources = ["docs"]

[[commands.field]]
id = "url"
label = "Print console URL instead of opening a browser"
type = "boolean"
option = ["--url"]
sources = ["docs"]

[[commands.field]]
id = "duration"
label = "Session duration"
description = "For example 1h."
type = "string"
option = ["--duration", "-d"]
sources = ["docs"]

[[commands.field]]
id = "active_role"
label = "Use the active role"
type = "boolean"
option = ["--active-role", "-ar"]
sources = ["docs"]

[[commands.task]]
id = "terminal"
label = "Assume a role in this terminal"
fields = ["profile", "region", "duration"]
required = []

[[commands.task]]
id = "console"
label = "Open a role in the AWS console"
set = { console = [true] }
lock = ["console"]
fields = ["profile", "console", "service", "region", "console_destination", "url"]
required = []

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["profile", "console", "service", "region"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["console_destination", "url", "duration", "active_role"]