oktaws

This program authenticates with Okta, assumes a provided role, and pulls a temporary key with STS to support the role assumption built into the aws cli.

Installation

Grab a binary for your OS from the latest release, and put it somewhere in your PATH. Linux, MacOS and Windows OSes are supported.

Setup

Run oktaws init to have oktaws generate a config file for you. You will be prompted for various config items.

Oktaws configuration resides in ~/.oktaws/<OKTA ACCOUNT>.toml files, and have the following fields:

username = '<USERNAME>'
role = '<DEFAULT ROLE>'

[profiles]
profile1 = '<OKTA APPLICATION NAME>'
profile2 = { application = '<OKTA APPLICATION NAME>', role = '<ROLE OVERRIDE>' }

The role value above is the name (not ARN) of the role you would like to log in as. This can be found when logging into the AWS console through Okta.

The ~/.aws/config file is read for information, but not modified. See Assuming a Role for information on configuring the AWS CLI to assume a role.

Usage

You can run oktaws refresh profile1 to generate keys for a single profile, or just oktaws refresh to generate keys for all profiles.

$ oktaws refresh [AWS profile]
$ aws --profile [AWS profile] [command]

for example

$ oktaws refresh production
$ aws --profile production ec2 describe-instances

Debugging

Login didn't work? Use the -v flag to emit more verbose logs. Add more -vs for increased verbosity:

$ oktaws refresh production -vv

Upgrading

v0.15

oktaws v0.15 contains potentially breaking changes to the interface by introducing subcommands.

If your profile name conflicts with a subcommand, then you must use the oktaws refresh <profile> syntax, to disambiguate the profile from subcommands.

M1 Issues

There are currently publish issues related to M1 macos artifacts. I recommend using x86_64 artifacts through rosetta until this is resolved

Contributors

• Jonathan Morley [@jonathanmorley]