{"id":29016668,"url":"https://github.com/chef/okta_aws","last_synced_at":"2025-06-25T22:33:21.740Z","repository":{"id":57448507,"uuid":"87114466","full_name":"chef/okta_aws","owner":"chef","description":"Tool for accessing the AWS API for an account you normally access via okta","archived":false,"fork":false,"pushed_at":"2021-08-24T13:06:47.000Z","size":96,"stargazers_count":27,"open_issues_count":1,"forks_count":9,"subscribers_count":72,"default_branch":"main","last_synced_at":"2025-05-24T21:18:32.869Z","etag":null,"topics":["aws-cli","okta"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/chef.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-04-03T19:48:47.000Z","updated_at":"2022-07-22T08:02:50.000Z","dependencies_parsed_at":"2022-09-16T13:53:05.417Z","dependency_job_id":null,"html_url":"https://github.com/chef/okta_aws","commit_stats":null,"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"purl":"pkg:github/chef/okta_aws","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chef%2Fokta_aws","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chef%2Fokta_aws/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chef%2Fokta_aws/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chef%2Fokta_aws/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/chef","download_url":"https://codeload.github.com/chef/okta_aws/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chef%2Fokta_aws/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261963255,"owners_count":23237146,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-cli","okta"],"created_at":"2025-06-25T22:31:09.363Z","updated_at":"2025-06-25T22:33:21.725Z","avatar_url":"https://github.com/chef.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Okta AWS tool\n\n[![Build Status](https://travis-ci.org/chef/okta_aws.svg?branch=master)](https://travis-ci.org/chef/okta_aws)\n\nThis tool is for accessing the AWS API for AWS accounts you normally log\ninto via okta. Normally, when you log in to an account via okta, you are\nassigned an IAM role, and don't have an actual user within AWS. This means you\ndon't have any API keys you can use to access the AWS API via the command\nline.\n\nThis tool will prompt you for your Okta credentials, and generate temporary\nAPI keys you can use to access the AWS API with.\n\n## Installation\n\nOkta_aws requires Python 3 to run.\n\n### macOS\n\nIf you have [Homebrew](https://brew.sh), you can use it to install `okta_aws`:\n\n    brew tap chef/okta_aws\n    brew install okta_aws\n\nTo do the same thing in one step, you can run:\n\n    brew install chef/okta_aws/okta_aws\n\n### Linux (Ubuntu)\n\nDue to a [bug](https://github.com/aws/aws-cli/issues/3820) in the\nversion of the AWS CLI found in Ubuntu packages, you will need to use\nthe AWS CLI installed via `pip` instead (`okta_aws` currently\ninteracts with the AWS API via the CLI).\n\nOnce you have installed the newer AWS CLI, you can install `okta_aws`\nusing `pip`:\n\n    sudo apt-get remove awscli\n    sudo apt-get install python3 python3-pip\n    sudo python3 -m pip install --upgrade awscli\n    sudo python3 -m pip install --upgrade okta_aws\n\n\n### Pip\n\nAlternatively, you can install via `pip`:\n\n    pip install okta_aws\n\n### Source\n\nTo install from source, clone this repository and run:\n\n    python setup.py install\n\n## Setup\n\nMake a file in your home directory called `.okta_aws.toml`:\n\n    [general]\n    username=\"yourusername\"\n    okta_server=\"yourcompany.okta.com\"\n\nThe values are as follows:\n\n* `username`: your okta username.\n* `okta_server`: the okta domain your company uses. It is usually something\n  like `yourcompanyname.okta.com`.\n\nThere are some optional settings too:\n\n* `short_profile_names` - okta_aws will fetch a list of AWS accounts you have\n  been assigned directly from okta, and will use the name in okta as the\n  profile name referred to by the AWS tools. However, the name of the\n  application in okta is often verbose. With this option turned on (it\n  defaults to true), the profile names will be shortened into something easier\n  to type. For example 'MyCompany Engineering (all devs) AWS' will become\n  `mycompany-engineering`. The exact rules are:\n  * Any trailing 'AWS' suffix, if present, is removed\n  * Anything in parentheses is stripped\n  * Everything is converted to lowercaase\n  * Spaces are stripped and replaced with dashes\n* `cookie_file` - the location where the okta session cookie is stored. This\n  defaults to `~/.okta_aws_cookie`.\n* `session_duration` - How long to request that the AWS temporary credentials\n  should be valid for. This defaults to `3600` (1 hour), but you can choose a\n  shorter or longer value up to `43200` (12 hours).\n  * Note: in order to choose a session length longer than 1 hour, you need to\n    configure the role in AWS to allow longer sessions. In the IAM console,\n    find the role and exit the `Maximum CLI/API session duration` setting.\n* `role_arn` - the ARN or name of the role to assume. This only needs to be\n  set if you have more than one role and are prompted to select which role to\n  assume when you run okta_aws.\n\nEach of these settings can be set per-profile. To do this, create a new\nsection in the configuration file with the name of the profile, and put your\nper-profile settings here. For example, in order to use a longer session\nlength for the `mycompany-dev` profile, add this to your `~/.okta_aws.toml`\nfile:\n\n```\n[mycompany-dev]\nsession_duration = 43200\n```\n\nOr, if you are prompted when logging into the `mycompany-staging` profile\nwhich role you want to use, then you can configure a default role as follows:\n\n```\n[mycompany-staging]\nrole_arn = \"Okta_PowerUser\"\n# Alternatively you can specify the full ARN\n# role_arn = \"arn:aws:iam::1234567890:role/Okta_PowerUser\"\n```\n\n### Profile aliases\n\nSometimes, the profile name obtained from okta doesn't match the profile name\nyou want to use in your AWS credentials file (for example, you might have a\nspecific profile name hardcoded in scripts). In these cases, you can configure\na profile name to be an _alias_ of another. To do this, add an `[aliases]`\nsection to your `.okta_aws.toml` file. For example, if `okta_aws --list` shows\nan available profile of `companyname-engineering` but you have\n`engineering` configured as a profile name in your scripts, you can do:\n\n```\n[aliases]\nengineering = \"companyname-engineering\"\n```\n\nThen, you just set `AWS_PROFILE` to `engineering`, or pass `engineering` as an\nargument to okta_aws, and it will log in with the `companyname-engineering`\nprofile, while storing the credentials in an `engineering` profile in your\n`~/.aws/credentials` file.\n\nIf you want to configure profile specific settings for a profile that has an\nalias, you can configure them under either the profile name itself, or the\nalias. If you configure the settings under the 'real' name of the profile,\nthen those settings will also be used if you refer to the profile by its\nalias. If you configure them under the alias, then they will only take effect\nif you refer to the profile by its alias.\n\n### GovCloud\n\nIf the profile name includes 'govcloud', then okta_aws will use the appropriate\nregion for fetching govcloud credentials (us-gov-east-1).\n\n## Usage\n\nRun `okta_aws PROFILENAME`, or run `okta_aws` without any arguments and\nokta_aws will use the `AWS_PROFILE` environment variable if you have it set.\n\nTo fetch credentials for all profiles you have access to, run `okta_aws --all`.\n\nTo list the available profiles, run `okta_aws --list`.\n\nThe first time you run `okta_aws`, you will be prompted for your okta username\nand password. On subsequent runs, if you are still logged into okta and your\nsession hasn't expired, then you won't have to log in again.\n\nOnce you have entered your okta username and password, a temporary token will\nbe obtained for you and stored in your AWS credentials file. You can then use\nthe aws api as normal, passing in the profile name you gave to okta_aws.\n\nIf you have been assigned multiple possible roles when the aws account was set\nup for you in okta, then you will be prompted which one of them you want to\nuse (e.g. Okta_PowerUser or Okta_AdminAccess). Select which one you want from\nthe menu if prompted. You can also configure a default role to assume in\n`~/.okta_aws.toml`.\n\nThe AWS token you receive will only last for an hour. To get a new token,\nre-run okta_aws.\n\n### Automatically refreshing the token\n\nYou can run okta_aws a second time to retrieve a new token before the old one\nexpires. If you wish, you can run one of the following to automatically refresh\nthe token once every 55 minutes (allowing some grace period before the token\nexpires):\n\n    while true; do okta_aws PROFILENAME; sleep 3300; done\n    while true; do okta_aws --all; sleep 3300; done\n\nokta_aws will run without prompting for anything one you have logged in and,\nif necessary, configured a default profile in `~/.okta_aws.toml`.\n\nUsers of zsh may find this `oh-my-zsh` plugin useful for shell-integrated\nauto-refresh:  [okta-aws plugin for zsh](https://gist.github.com/irvingpop/8e4e3bc63497be3432e695a52ef885f0)\n\n## Troubleshooting\n\nIf you're having issues running okta_aws, there's a few things to check:\n`okta_aws --version` - should match most recent\n`python --version` - should be 3.X\n\nWe also recently saw someone where the error looked like this, user had environment variables set that put python 3.6 directories first in the PATH, when python 3.7 was installed. Removing those lines from `.bash_profile` fixed the issue:\n`-bash: /Library/Frameworks/Python.framework/Versions/3.6/bin/okta_aws: /usr/local/Cellar/okta_aws/0.5.3/libexec/bin/python3.7: bad interpreter: No such file or directory`\n\n## Similar projects\n\n* [okta-aws-cli-assume-role](https://github.com/oktadeveloper/okta-aws-cli-assume-role) - Okta's own tool\n* [oktaauth](https://github.com/ThoughtWorksInc/oktaauth) - Python library for working with okta\n* [segmentio/aws-okta](https://github.com/segmentio/aws-okta) - uses assumerole\n  to connect to multiple aws accounts while signing into a primary aws account\n  in okta.\n* [aws-vault](https://github.com/99designs/aws-vault) - tool for securely storing aws credentials\n* [okta_aws_login](https://github.com/nimbusscale/okta_aws_login)\n* [okta-awscli](https://github.com/jmhale/okta-awscli)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchef%2Fokta_aws","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchef%2Fokta_aws","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchef%2Fokta_aws/lists"}