$ show Nike-Inc/gimme-aws-creds
gimme-aws-creds is a Python CLI tool for obtaining temporary AWS and Alibaba Cloud credentials via Okta SAML authentication. It supports both Okta Classic and Identity Engine flows, handles multiple MFA methods (push, TOTP, hardware tokens, SMS, email, FIDO2/WebAuthn, Duo), and exchanges SAML assertions for temporary cloud credentials. The tool outputs credentials in various formats (export, JSON, Windows PowerShell) or writes them to standard credential files (~/.aws/credentials, ~/.aliyun/config.json). The application features a modular architecture with separate modules for Okta authentication (okta_classic.py, okta_identity_engine.py), cloud provider resolution (aws.py, alibaba_cloud.py), configuration management (config.py), MFA handling (duo.py, u2f.py, webauthn.py), and shared utilities (common.py, ui.py, debug_formatter.py). Key entry points include bin/gimme-aws-creds (main executable) and platform-specific wrappers. Data flows involve parsing configuration/authentication options, performing Okta authentication with MFA, extracting SAML assertions, assuming cloud roles via STS APIs, and formatting output. Notable reusable components include a flexible configuration system with inheritance and source tracking (config.py), isolated SAML parsing utilities (common.py), a UI abstraction layer for testability (ui.py), and a secure HTTP logging formatter that automatically redacts sensitive data (debug_formatter.py). The project is actively maintained but shows medium technical drift due to platform-specific WebAuthn dependencies requiring older Python versions on Windows and the complexity of maintaining compatibility with multiple authentication systems and cloud providers.
The LLM identified 4 files worth highlighting for reuse:
Implements a configuration system supporting multiple sources (CLI, environment variables, file, profile) with profile inheritance and source tracking for debugging. This flexible pattern allows configuration override precedence and is reusable in other CLI applications.
Contains isolated utility functions for parsing SAML responses from HTML forms (parse_saml_form) and extracting role attributes (parse_saml_role_attributes). These pure functions have no internal dependencies beyond standard libraries and are reusable in any SAML-based authentication flow.
Defines an abstract base class (UserInterface) for user interactions, enabling different implementations (CLI, mock for testing) and promoting separation of concerns. This pattern allows core logic to remain UI-agnostic and enhances testability.
Provides a logging formatter that automatically redacts sensitive data (passwords, tokens, etc.) from HTTP request and response logs. This reusable component prevents accidental credential leakage in logs and can be integrated into any Python application making HTTP requests.