id = "okta-aws-cli"
name = "Okta AWS CLI"
homepage = "https://github.com/okta/okta-aws-cli"
description = "A command-line tool for authenticating to AWS through Okta."
executables = ["okta-aws-cli"]

[dotfiles]

# https://github.com/okta/okta-aws-cli documents ~/.okta/okta.yaml as the
# configuration file used by the official Okta tool. It contains the Okta
# organization and client/federation application settings, so keep the file
# protected as a whole rather than guessing at YAML key names.
paths = []
secret = ["~/.okta/okta.yaml"]
side_effect = false

[commands]
format = 1
label = "Get AWS credentials via Okta"
description = "Human web (device authorization) flow. Other commands (m2m, direct), private keys and passwords are outside this form."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.source]]
id = "readme"
kind = "help"
url = "https://github.com/okta/okta-aws-cli/blob/master/README.md"
revision = "master"
evidence = '''
$ okta-aws-cli web --oidc-client-id 0oabc --aws-acct-fed-app-id 0oaxy --org-domain my-org.okta.com
| AWS Region (**optional**) | ... | `--aws-region [value]` | `OKTA_AWSCLI_AWS_REGION` |
| Okta Org Domain (**required**) | ... | `--org-domain [value]` | `OKTA_AWSCLI_ORG_DOMAIN` |
| OIDC Client ID (**required**) | ... | `--oidc-client-id [value]` | `OKTA_AWSCLI_OIDC_CLIENT_ID` |
| AWS IAM Role ARN | ... | `--aws-iam-role [value]` | `OKTA_AWSCLI_IAM_ROLE` |
| AWS Session Duration | The lifetime, in seconds, of the AWS credentials. Must be between 60 and 43200. | `--aws-session-duration [value]` | `OKTA_AWSCLI_SESSION_DURATION` |
| Output format | Default is `env-var`. Options: `env-var` for output to environment variables, `aws-credentials` for output to AWS credentials file, `process-credentials` for credentials as JSON, or `noop` for no output which can be useful with `--exec` | `--format [value]` | `OKTA_AWSCLI_FORMAT` |
| Profile | Default is `default` | `--profile [value]` | `OKTA_AWSCLI_PROFILE` |
| Cache Okta access token ... | `true` if flag is present | `--cache-access-token` | `OKTA_AWSCLI_CACHE_ACCESS_TOKEN=true` |
| (Over)write the given profile to the AWS credentials file. WARNING: When enabled, overwriting can inadvertently remove dangling comments and extraneous formatting from the creds file. | `true` if flag is present | `--write-aws-credentials` | `OKTA_AWSCLI_WRITE_AWS_CREDENTIALS=true` |
| Print operational information to the screen for debugging purposes | `true` if flag is present | `--debug` | `OKTA_AWSCLI_DEBUG=true` |
| Okta AWS Account Federation integration app ID | ... | `--aws-acct-fed-app-id [value]` | `OKTA_AWSCLI_AWS_ACCOUNT_FEDERATION_APP_ID` |
| Display QR Code | `true` if flag is present | `--qr-code` | `OKTA_AWSCLI_QR_CODE=true` |
'''

[[commands.field]]
id = "org_domain"
label = "Okta org domain"
description = "For example my-org.okta.com."
type = "string"
option = ["--org-domain"]
sources = ["readme"]

[[commands.field]]
id = "oidc_client_id"
label = "OIDC client ID"
type = "string"
option = ["--oidc-client-id"]
sources = ["readme"]

[[commands.field]]
id = "aws_acct_fed_app_id"
label = "AWS Account Federation app ID"
type = "string"
option = ["--aws-acct-fed-app-id"]
sources = ["readme"]

[[commands.field]]
id = "aws_iam_role"
label = "Preferred IAM role ARN"
type = "string"
option = ["--aws-iam-role"]
sources = ["readme"]

[[commands.field]]
id = "aws_region"
label = "AWS region"
type = "string"
option = ["--aws-region"]
sources = ["readme"]

[[commands.field]]
id = "session_duration"
label = "Session duration (seconds)"
description = "Between 60 and 43200."
type = "integer"
option = ["--aws-session-duration"]
sources = ["readme"]

[[commands.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["--format"]
choices = [
  { value = "env-var", label = "Environment variables" },
  { value = "aws-credentials", label = "AWS credentials file" },
  { value = "process-credentials", label = "Process credentials JSON" },
  { value = "noop", label = "No output" },
]
sources = ["readme"]

[[commands.field]]
id = "profile"
label = "Profile name"
type = "string"
option = ["--profile"]
sources = ["readme"]

[[commands.field]]
id = "write_aws_credentials"
label = "Write to AWS credentials file"
description = "Overwriting can remove comments and formatting from the credentials file."
type = "boolean"
option = ["--write-aws-credentials"]
effect = "overwrite"
sources = ["readme"]

[[commands.field]]
id = "cache_access_token"
label = "Cache Okta access token"
type = "boolean"
option = ["--cache-access-token"]
sources = ["readme"]

[[commands.field]]
id = "qr_code"
label = "Display QR code"
type = "boolean"
option = ["--qr-code"]
sources = ["readme"]

[[commands.field]]
id = "debug"
label = "Debug output"
type = "boolean"
option = ["--debug"]
sources = ["readme"]

[[commands.task]]
id = "web_login"
label = "Web login"
fields = ["org_domain", "oidc_client_id", "aws_acct_fed_app_id", "aws_iam_role"]
required = ["org_domain", "oidc_client_id"]

[[commands.task]]
id = "save_profile"
label = "Save to credentials file"
fields = ["org_domain", "oidc_client_id", "aws_acct_fed_app_id", "profile", "write_aws_credentials", "format"]
required = ["org_domain", "oidc_client_id", "profile"]
set = { write_aws_credentials = [true], format = ["aws-credentials"] }

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["org_domain", "oidc_client_id", "aws_acct_fed_app_id", "aws_iam_role", "profile"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["aws_region", "session_duration", "format", "write_aws_credentials", "cache_access_token", "qr_code", "debug"]