id       = "okta-awscli"
name     = "okta-awscli"
homepage = "https://github.com/jmhale/okta-awscli"
executables   = ["okta-awscli"]

[dotfiles]

# README: the tool reads "~/.okta-aws", an INI file with one section per Okta
# profile, and its sample is
#
#   [default]
#   base-url = <your_okta_org>.okta.com
#   username = <your_okta_username>
#   password = <your_okta_password>
#   factor   = <your_preferred_mfa_factor>
#   role     = <your_preferred_okta_role>
#   profile  = <aws_profile_to_store_credentials>
#   app-link = <app_link_from_okta>
#   duration = 3600
#
# The AWS App and Role selections are written back into the same file as they
# are chosen.
#
# This is not Okta's own `okta-aws-cli`, which reads ~/.okta/okta.yaml — that
# file belongs to the `okta` entry. Different tool, different file.
paths = ["~/.okta-aws"]

exclude = []

# Not a whole-file secret: the org URL, the MFA factor, the app link, the role
# and the AWS profile name are ordinary settings worth carrying. The one
# credential is carved out below.
secret = []

# `password` is the Okta account password, stored in the clear when the user
# chooses to keep it there rather than be prompted. The temporary AWS keys the
# tool mints go to ~/.aws/credentials, which the `aws` entry classifies.
[[dotfiles.secret_paths]]
file  = "~/.okta-aws"
match = { prefix = ["password"] }

# No machine_lines: an Okta org, an app link and a role are properties of the
# account, not of the laptop it is used from.

[commands]
format = 1
label = "Get AWS credentials via Okta"
description = "Authenticate to Okta and fetch temporary AWS STS credentials, optionally running an awscli command. Passwords are deliberately not offered as a field."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = true }

[[commands.source]]
id = "readme"
kind = "help"
url = "https://github.com/jmhale/okta-awscli/blob/main/README.md"
revision = "main"
evidence = '''
`okta-awscli --profile <aws_profile> <awscli action> <awscli arguments>`
- `--profile` or `-p` Sets your temporary credentials to a profile in `.aws/credentials`. If omitted and not configured in `~/.okta-aws`, credentials will output to console.
- `--username` or `-U` Okta username.
- `--force` or `-f` Ignores result of STS credentials validation and gets new credentials from AWS. Used in conjunction with `--profile`.
- `--verbose` or `-v` More verbose output.
- `--debug` or `-d` Very verbose output. Useful for debugging.
- `--cache` or `-c` Cache the acquired credentials to ~/.okta-credentials.cache (only if --profile is unspecified)
- `--okta-profile` or `-o` Use a Okta profile, other than `default` in `.okta-aws`. Useful for multiple Okta tenants.
- `--token` or `-t` Pass in the TOTP token from your authenticator
- `--refresh-role` or `-r` Refresh the AWS role to be assumed.
- `--lookup` or `-l` Lookup and return the AWS Account Alias for each role, instead of returning the raw ARN.
- `--config` Add/Create new Okta profile configuration.
'''

[[commands.field]]
id = "profile"
label = "AWS profile to write"
description = "Without a profile, credentials are printed to the console."
type = "string"
option = ["--profile", "-p"]
sources = ["readme"]

[[commands.field]]
id = "okta_profile"
label = "Okta profile"
type = "string"
option = ["--okta-profile", "-o"]
sources = ["readme"]

[[commands.field]]
id = "username"
label = "Okta username"
type = "string"
option = ["--username", "-U"]
sources = ["readme"]

[[commands.field]]
id = "token"
label = "TOTP token"
type = "string"
option = ["--token", "-t"]
sources = ["readme"]

[[commands.field]]
id = "force"
label = "Force new credentials"
type = "boolean"
option = ["--force", "-f"]
sources = ["readme"]

[[commands.field]]
id = "refresh_role"
label = "Refresh the AWS role"
type = "boolean"
option = ["--refresh-role", "-r"]
sources = ["readme"]

[[commands.field]]
id = "lookup"
label = "Show account aliases"
type = "boolean"
option = ["--lookup", "-l"]
sources = ["readme"]

[[commands.field]]
id = "cache"
label = "Cache credentials"
type = "boolean"
option = ["--cache", "-c"]
sources = ["readme"]

[[commands.field]]
id = "verbose"
label = "Verbose output"
type = "boolean"
option = ["--verbose", "-v"]
sources = ["readme"]

[[commands.field]]
id = "debug"
label = "Debug output"
type = "boolean"
option = ["--debug", "-d"]
sources = ["readme"]

[[commands.field]]
id = "config"
label = "Create an Okta profile"
type = "boolean"
option = ["--config"]
sources = ["readme"]

[[commands.field]]
id = "awscli_args"
label = "awscli command"
description = "Optional awscli action and arguments to run with the credentials, e.g. iam list-users."
type = "string"
position = 0
multiple = true
sources = ["readme"]

[[commands.task]]
id = "login"
label = "Write credentials to a profile"
fields = ["profile", "okta_profile", "force", "token"]
required = ["profile"]

[[commands.task]]
id = "configure"
label = "Configure an Okta profile"
fields = ["config"]
required = ["config"]
set = { config = [true] }

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["profile", "okta_profile", "username", "token", "awscli_args"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["force", "refresh_role", "lookup", "cache", "verbose", "debug", "config"]