id = "saml2aws"
name = "saml2aws"
homepage = "https://github.com/Versent/saml2aws"
description = "A command-line tool that converts SAML assertions into AWS credentials."
executables = ["saml2aws"]
[dotfiles]
paths = ["~/.saml2aws"]
exclude = []
secret = []
[commands]
format = 1
label = "saml2aws"
description = "Log in to a SAML identity provider for temporary AWS credentials, or run a command with them. Provider-specific login flags (Okta, OneLogin, F5 APM) are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }
[[commands.subcommand]]
path = ["login"]
label = "Log in and fetch credentials"
description = "Login to a SAML 2.0 IDP and convert the SAML assertion to an STS token."
[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/Versent/saml2aws#usage"
revision = "2026-10-27"
evidence = """
-a, --idp-account="default" The name of the configured IDP account. (env: SAML2AWS_IDP_ACCOUNT)
-s, --skip-verify Skip verification of server certificate. (env: SAML2AWS_SKIP_VERIFY)
--skip-prompt Skip prompting for parameters during login.
--session-duration=SESSION-DURATION
--role=ROLE The ARN of the role to assume. (env: SAML2AWS_ROLE)
login [<flags>]
Login to a SAML 2.0 IDP and convert the SAML assertion to an STS token.
-p, --profile=PROFILE The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)
--force Refresh credentials even if not expired.
--credential-process Enables AWS Credential Process support by outputting credentials to STDOUT in a JSON message.
"""
[[commands.subcommand.field]]
id = "idp_account"
label = "IDP account"
type = "string"
option = ["--idp-account", "-a"]
sources = ["help"]
[[commands.subcommand.field]]
id = "profile"
label = "AWS profile"
description = "Profile that receives the temporary credentials."
type = "string"
option = ["--profile", "-p"]
sources = ["help"]
[[commands.subcommand.field]]
id = "role"
label = "Role ARN"
type = "string"
option = ["--role"]
sources = ["help"]
[[commands.subcommand.field]]
id = "session_duration"
label = "Session duration (seconds)"
type = "integer"
option = ["--session-duration"]
sources = ["help"]
[[commands.subcommand.field]]
id = "force"
label = "Force refresh"
description = "Refresh credentials even if not expired."
type = "boolean"
option = ["--force"]
sources = ["help"]
[[commands.subcommand.field]]
id = "skip_prompt"
label = "Skip prompts"
type = "boolean"
option = ["--skip-prompt"]
sources = ["help"]
[[commands.subcommand.field]]
id = "skip_verify"
label = "Skip certificate verification"
type = "boolean"
option = ["--skip-verify", "-s"]
sources = ["help"]
[[commands.subcommand.task]]
id = "login"
label = "Log in"
fields = ["idp_account", "profile", "role", "session_duration", "force"]
[[commands.subcommand.task]]
id = "refresh"
label = "Force a refresh"
set = { force = [true] }
lock = ["force"]
fields = ["idp_account", "profile", "force", "skip_prompt"]
[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["idp_account", "profile", "role", "force"]
[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["session_duration", "skip_prompt", "skip_verify"]
[[commands.subcommand]]
path = ["exec"]
label = "Run a command with credentials"
description = "Exec the supplied command with env vars from STS token."
[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/Versent/saml2aws#usage"
revision = "2026-10-27"
evidence = """
exec [<flags>] [<command>...]
Exec the supplied command with env vars from STS token.
-p, --profile=PROFILE The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)
--exec-profile=EXEC-PROFILE
"""
[[commands.subcommand.field]]
id = "profile"
label = "AWS profile"
type = "string"
option = ["--profile", "-p"]
sources = ["help"]
[[commands.subcommand.field]]
id = "exec_profile"
label = "Execution profile"
description = "Profile used for command execution, e.g. for secondary role assumption."
type = "string"
option = ["--exec-profile"]
sources = ["help"]
[[commands.subcommand.field]]
id = "command"
label = "Command"
type = "string"
position = 0
multiple = true
min = 1
sources = ["help"]
[[commands.subcommand.task]]
id = "exec"
label = "Run a command"
fields = ["profile", "exec_profile", "command"]
required = ["command"]
[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["profile", "exec_profile", "command"]
[[commands.subcommand]]
path = ["console"]
label = "Open the AWS console"
description = "Console will open the aws console after logging in."
[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/Versent/saml2aws#usage"
revision = "2026-10-27"
evidence = """
console [<flags>]
Console will open the aws console after logging in.
-p, --profile=PROFILE The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)
--force Refresh credentials even if not expired.
--link Present link to AWS console instead of opening browser
"""
[[commands.subcommand.field]]
id = "profile"
label = "AWS profile"
type = "string"
option = ["--profile", "-p"]
sources = ["help"]
[[commands.subcommand.field]]
id = "force"
label = "Force refresh"
type = "boolean"
option = ["--force"]
sources = ["help"]
[[commands.subcommand.field]]
id = "link"
label = "Print link only"
description = "Present a link instead of opening the browser."
type = "boolean"
option = ["--link"]
sources = ["help"]
[[commands.subcommand.task]]
id = "console"
label = "Open console"
fields = ["profile", "force", "link"]
[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["profile", "force", "link"]
