https://github.com/lob/aws-creds
CLI tool to authenticate with Okta as the IdP to fetch AWS credentials
https://github.com/lob/aws-creds
aws cli credentials idp okta saml sts
Last synced: 28 days ago
JSON representation
CLI tool to authenticate with Okta as the IdP to fetch AWS credentials
- Host: GitHub
- URL: https://github.com/lob/aws-creds
- Owner: lob
- License: mit
- Created: 2018-03-06T06:01:10.000Z (over 7 years ago)
- Default Branch: main
- Last Pushed: 2023-10-11T17:52:57.000Z (over 1 year ago)
- Last Synced: 2024-06-20T10:16:00.073Z (12 months ago)
- Topics: aws, cli, credentials, idp, okta, saml, sts
- Language: Go
- Size: 129 KB
- Stars: 12
- Watchers: 51
- Forks: 6
- Open Issues: 6
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# aws-creds
A CLI tool to authenticate with Okta as the IdP to fetch AWS credentials.
## Installation
> Note: Building `aws-creds` requires `go >= 1.13`.
To install `aws-creds`:
1. Clone this repository.
2. Run `make build`.
3. Copy `./bin/aws-creds` to `/usr/local/bin`, or your preferred executables folder.
> Note: You can set the `BIN_DIR` and `VERSION` environment variables to override the build destination and version number.
>
> For example, building aws-creds directly into my `~/home/bin` directory:
> ```
> [aws-creds]$ VERSION=vX.Y.Z BIN_DIR=$HOME/bin make build
> [aws-creds]$ ~/bin/aws-creds -v
> aws-creds vX.Y.Z
> ```
## Usage
> Note: This assumes you have already installed the [AWS CLI](https://aws.amazon.com/cli/).
Once you have installed `aws-creds`, run `aws-creds configure`.
This will prompt you for your okta username, okta host + okta aws app path, and information about your aws profiles + role ARNs.
```
$ aws-creds configure
Configuring global settings...
Okta username: yourname
Okta AWS Embed Link (e.g. https://example.okta.com/home/amazon_aws/0oa54k1gk2ukOJ9nGDt7/252): https://example.okta.com/home/amazon_aws/0oa54k1gk2ukOJ9nGDt7/123
Configuring profile settings...
Profile name: test
Role ARN (e.g. arn:aws:iam::123456789001:role/EngineeringRole): arn:aws:iam::123456789001:role/SomeRole
Do you want to configure more profiles? [y/N]:
```
Once complete, `aws-creds` will create the file `$HOME/.aws-creds/config` with this information.
To fetch credentials, run `aws-creds -p`:
```
$ aws-creds -p $PROFILE_NAME
```
This may prompt you for your Okta password, preferred multi-factor auth method, and then your one-time password.
Please note that push-based authentication methods are not supported by this tool. You may need to add an additional verification method to your Okta account that uses an OTP. Google Authenticator and Okta Verify both work.
`aws-creds` will then populate your `$HOME/.aws/credentials` file with credentials from Okta.
Finally pass `--profile=$PROFILE_NAME`, or set `AWS_PROFILE=$PROFILE_NAME`, when running `aws` commands.
For example:
```
$ aws s3 ls --profile $PROFILE_NAME
$ AWS_PROFILE=sandbox aws s3 ls # Equivalent
$ export AWS_PROFILE=sandbox # Also
$ aws s3 ls # Equivalent
```
> Note: these credentials expire every hour, so you will need to re-run `aws-creds -p $PROFILE_NAME` periodically.
### Headless Linux / WSL Users
This utility uses a keyring library that is incompatible with certain linux configurations. To disable keyring caching, modify the `~/.aws-creds/config` file to include `"enable_keyring" : false,` after setting up the tool.
## Building
`aws-creds` has a Makefile with helper commands:
make command | description
--- | ---
`make build` | Builds executable. Set `VERSION` and `BIN` environment variables to override defaults.
`make clean` | Clean `BIN` folder and go cache.
`make test` | Runs unit tests and generates coverage report.
`make install`| Installs go dependencies.
`make lint` | Lints the codebase.
`make release` | Creates and pushes a git tag.
`make setup` | Sets up linting and changelog tools.
`make html` | Generates test coverage report.
`make enforce` | Enforces test coverage.