otty / apps

All apps/Okta AWS CLI

Okta AWS CLI

okta-aws-cli

A command-line tool for authenticating to AWS through Okta.

Runs as okta-aws-cli|macOS, Linux, Windows|github.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Okta AWS CLI in your home directory Every rule on this page, by file

· ~/.okta/okta.yaml Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/okta-aws-cli/otty.tomlThe file this page is generated from

id = "okta-aws-cli"

name = "Okta AWS CLI"

homepage = "https://github.com/okta/okta-aws-cli"

description = "A command-line tool for authenticating to AWS through Okta."

executables = ["okta-aws-cli"]

[dotfiles]

# https://github.com/okta/okta-aws-cli documents ~/.okta/okta.yaml as the

# configuration file used by the official Okta tool. It contains the Okta

# organization and client/federation application settings, so keep the file

# protected as a whole rather than guessing at YAML key names.

paths = []

secret = ["~/.okta/okta.yaml"]

side_effect = false

[commands]

format = 1

label = "Get AWS credentials via Okta"

description = "Human web (device authorization) flow. Other commands (m2m, direct), private keys and passwords are outside this form."

quality = "ai-draft"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.source]]

id = "readme"

kind = "help"

url = "https://github.com/okta/okta-aws-cli/blob/master/README.md"

revision = "master"

evidence = '''

$ okta-aws-cli web --oidc-client-id 0oabc --aws-acct-fed-app-id 0oaxy --org-domain my-org.okta.com

| Output format | Default is `env-var`. Options: `env-var` for output to environment variables, `aws-credentials` for output to AWS credentials file, `process-credentials` for credentials as JSON, or `noop` for no output which can be useful with `--exec` | `--format [value]` | `OKTA_AWSCLI_FORMAT` |

| (Over)write the given profile to the AWS credentials file. WARNING: When enabled, overwriting can inadvertently remove dangling comments and extraneous formatting from the creds file. | `true` if flag is present | `--write-aws-credentials` | `OKTA_AWSCLI_WRITE_AWS_CREDENTIALS=true` |

'''

[[commands.field]]

id = "org_domain"

label = "Okta org domain"

description = "For example my-org.okta.com."

type = "string"

option = ["--org-domain"]

sources = ["readme"]

[[commands.field]]

id = "oidc_client_id"

label = "OIDC client ID"

type = "string"

option = ["--oidc-client-id"]

sources = ["readme"]

[[commands.field]]

id = "aws_acct_fed_app_id"

label = "AWS Account Federation app ID"

type = "string"

option = ["--aws-acct-fed-app-id"]

sources = ["readme"]

[[commands.field]]

id = "aws_iam_role"

label = "Preferred IAM role ARN"

type = "string"

option = ["--aws-iam-role"]

sources = ["readme"]

[[commands.field]]

id = "aws_region"

label = "AWS region"

type = "string"

option = ["--aws-region"]

sources = ["readme"]

[[commands.field]]

id = "session_duration"

label = "Session duration (seconds)"

description = "Between 60 and 43200."

type = "integer"

option = ["--aws-session-duration"]

sources = ["readme"]

[[commands.field]]

id = "format"

label = "Output format"

type = "enum"

option = ["--format"]

choices = [

{ value = "env-var", label = "Environment variables" },

{ value = "aws-credentials", label = "AWS credentials file" },

{ value = "process-credentials", label = "Process credentials JSON" },

{ value = "noop", label = "No output" },

]

sources = ["readme"]

[[commands.field]]

id = "profile"

label = "Profile name"

type = "string"

option = ["--profile"]

sources = ["readme"]

[[commands.field]]

id = "write_aws_credentials"

label = "Write to AWS credentials file"

description = "Overwriting can remove comments and formatting from the credentials file."

type = "boolean"

option = ["--write-aws-credentials"]

effect = "overwrite"

sources = ["readme"]

[[commands.field]]

id = "cache_access_token"

label = "Cache Okta access token"

type = "boolean"

option = ["--cache-access-token"]

sources = ["readme"]

[[commands.field]]

id = "qr_code"

label = "Display QR code"

type = "boolean"

option = ["--qr-code"]

sources = ["readme"]

[[commands.field]]

id = "debug"

label = "Debug output"

type = "boolean"

option = ["--debug"]

sources = ["readme"]

[[commands.task]]

id = "web_login"

label = "Web login"

fields = ["org_domain", "oidc_client_id", "aws_acct_fed_app_id", "aws_iam_role"]

required = ["org_domain", "oidc_client_id"]

[[commands.task]]

id = "save_profile"

label = "Save to credentials file"

fields = ["org_domain", "oidc_client_id", "aws_acct_fed_app_id", "profile", "write_aws_credentials", "format"]

required = ["org_domain", "oidc_client_id", "profile"]

set = { write_aws_credentials = [true], format = ["aws-credentials"] }

[[commands.group]]

id = "basic"

label = "Basic"

fields = ["org_domain", "oidc_client_id", "aws_acct_fed_app_id", "aws_iam_role", "profile"]

[[commands.group]]

id = "advanced"

label = "Advanced"

fields = ["aws_region", "session_duration", "format", "write_aws_credentials", "cache_access_token", "qr_code", "debug"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/okta-aws-cli. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out.