CredSummoner

CredSummoner is a tool that developers can use to generate temporary AWS credentials. It works by integrating with your identity provider for user authentication and AWS role access. As of now, the only supported identity provider is Okta.

First, CredSummoner must be configured to use the proper Okta embed link for AWS access:

credsummoner config okta_aws_embed_link https://example.okta.com/home/amazon_aws/xxxxxxxxxxxxxxxxxxxx/999

Once configured, credsummoner get may be used like so:

credsummoner get your-okta-username

CredSummoner will prompt for a password and TOTP token. Upon successful authentication, CredSummoner will prompt for the AWS account and IAM role to assume. A new shell process is then created with the following environment variables configured with a fresh set of temporary AWS credentials:

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN

There are several other ways to invoke credsummoner get. For example, if you know the AWS account alias and IAM role name, you can skip the prompts like so:

credsummoner get your-okta-username --account=foo --role=Developer

You can also tell CredSummoner to spawn an arbitrary program rather than a shell:

credsummoner get your-okta-username -- rails server

Or, you can skip spawning another program altogether and just print out environment variables for easy copy/pasting elsewhere:

credsummoner get your-okta-username --env

By default, CredSummoner tries to generate credentials that are valid for 12 hours, the maximum currently allowed by AWS STS. If an IAM role has a lower maximum session duration, then the --duration flag must be used to set the desired session duration (in seconds) without exceeding the limit.

CredSummoner is a Ruby gem, and thus can be easily installed with the gem program:

gem install credsummoner