otty / apps

All apps/okta-awscli

okta-awscli

Runs as okta-awscli|macOS, Linux, Windows|github.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

okta-awscli in your home directory Every rule on this page, by file

password

Lifted into your secret store; the rest of the file syncs.

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/okta-awscli/otty.tomlThe file this page is generated from

id = "okta-awscli"

name = "okta-awscli"

homepage = "https://github.com/jmhale/okta-awscli"

executables = ["okta-awscli"]

[dotfiles]

# README: the tool reads "~/.okta-aws", an INI file with one section per Okta

# profile, and its sample is

# [default]

# base-url = <your_okta_org>.okta.com

# username = <your_okta_username>

# password = <your_okta_password>

# factor = <your_preferred_mfa_factor>

# role = <your_preferred_okta_role>

# profile = <aws_profile_to_store_credentials>

# app-link = <app_link_from_okta>

# duration = 3600

# The AWS App and Role selections are written back into the same file as they

# are chosen.

# This is not Okta's own `okta-aws-cli`, which reads ~/.okta/okta.yaml — that

# file belongs to the `okta` entry. Different tool, different file.

paths = ["~/.okta-aws"]

exclude = []

# Not a whole-file secret: the org URL, the MFA factor, the app link, the role

# and the AWS profile name are ordinary settings worth carrying. The one

# credential is carved out below.

secret = []

# `password` is the Okta account password, stored in the clear when the user

# chooses to keep it there rather than be prompted. The temporary AWS keys the

# tool mints go to ~/.aws/credentials, which the `aws` entry classifies.

[[dotfiles.secret_paths]]

file = "~/.okta-aws"

match = { prefix = ["password"] }

# No machine_lines: an Okta org, an app link and a role are properties of the

# account, not of the laptop it is used from.

[commands]

format = 1

label = "Get AWS credentials via Okta"

description = "Authenticate to Okta and fetch temporary AWS STS credentials, optionally running an awscli command. Passwords are deliberately not offered as a field."

quality = "ai-draft"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = true }

[[commands.source]]

id = "readme"

kind = "help"

url = "https://github.com/jmhale/okta-awscli/blob/main/README.md"

revision = "main"

evidence = '''

`okta-awscli --profile <aws_profile> <awscli action> <awscli arguments>`

- `--profile` or `-p` Sets your temporary credentials to a profile in `.aws/credentials`. If omitted and not configured in `~/.okta-aws`, credentials will output to console.

- `--username` or `-U` Okta username.

- `--force` or `-f` Ignores result of STS credentials validation and gets new credentials from AWS. Used in conjunction with `--profile`.

- `--verbose` or `-v` More verbose output.

- `--debug` or `-d` Very verbose output. Useful for debugging.

- `--cache` or `-c` Cache the acquired credentials to ~/.okta-credentials.cache (only if --profile is unspecified)

- `--okta-profile` or `-o` Use a Okta profile, other than `default` in `.okta-aws`. Useful for multiple Okta tenants.

- `--token` or `-t` Pass in the TOTP token from your authenticator

- `--refresh-role` or `-r` Refresh the AWS role to be assumed.

- `--lookup` or `-l` Lookup and return the AWS Account Alias for each role, instead of returning the raw ARN.

- `--config` Add/Create new Okta profile configuration.

'''

[[commands.field]]

id = "profile"

label = "AWS profile to write"

description = "Without a profile, credentials are printed to the console."

type = "string"

option = ["--profile", "-p"]

sources = ["readme"]

[[commands.field]]

id = "okta_profile"

label = "Okta profile"

type = "string"

option = ["--okta-profile", "-o"]

sources = ["readme"]

[[commands.field]]

id = "username"

label = "Okta username"

type = "string"

option = ["--username", "-U"]

sources = ["readme"]

[[commands.field]]

id = "token"

label = "TOTP token"

type = "string"

option = ["--token", "-t"]

sources = ["readme"]

[[commands.field]]

id = "force"

label = "Force new credentials"

type = "boolean"

option = ["--force", "-f"]

sources = ["readme"]

[[commands.field]]

id = "refresh_role"

label = "Refresh the AWS role"

type = "boolean"

option = ["--refresh-role", "-r"]

sources = ["readme"]

[[commands.field]]

id = "lookup"

label = "Show account aliases"

type = "boolean"

option = ["--lookup", "-l"]

sources = ["readme"]

[[commands.field]]

id = "cache"

label = "Cache credentials"

type = "boolean"

option = ["--cache", "-c"]

sources = ["readme"]

[[commands.field]]

id = "verbose"

label = "Verbose output"

type = "boolean"

option = ["--verbose", "-v"]

sources = ["readme"]

[[commands.field]]

id = "debug"

label = "Debug output"

type = "boolean"

option = ["--debug", "-d"]

sources = ["readme"]

[[commands.field]]

id = "config"

label = "Create an Okta profile"

type = "boolean"

option = ["--config"]

sources = ["readme"]

[[commands.field]]

id = "awscli_args"

label = "awscli command"

description = "Optional awscli action and arguments to run with the credentials, e.g. iam list-users."

type = "string"

position = 0

multiple = true

sources = ["readme"]

[[commands.task]]

id = "login"

label = "Write credentials to a profile"

fields = ["profile", "okta_profile", "force", "token"]

required = ["profile"]

[[commands.task]]

id = "configure"

label = "Configure an Okta profile"

fields = ["config"]

required = ["config"]

set = { config = [true] }

[[commands.group]]

id = "basic"

label = "Basic"

fields = ["profile", "okta_profile", "username", "token", "awscli_args"]

[[commands.group]]

id = "advanced"

label = "Advanced"

fields = ["force", "refresh_role", "lookup", "cache", "verbose", "debug", "config"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/okta-awscli. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these is generated from the same rules as this page.