aws-profile-scripts

⚠️ This package is deprecated. Both commands it provided — aws-mfa and add-aws-profile — have been superseded by the native AWS CLI sign-in flow (aws configure sso → aws login / aws logout), which auto-refreshes temporary credentials and removes the need for long-lived or pasted secrets. The commands now print deprecation notices instead of performing their old behavior. See the per-command sections below, and the AWS docs: https://docs.aws.amazon.com/signin/latest/userguide/command-line-sign-in.html

Installation

npm i --location=global @20i/aws-profile-scripts

Usage

Scenario 1: MFA device — aws-mfa is DEPRECATED

⚠️ aws-mfa is deprecated. It previously fetched temporary STS session-token credentials using your MFA device and stored them in an AWS profile. The modern AWS CLI now provides a built-in browser sign-in flow (aws login / aws logout) that removes the need for this script — and for long-lived IAM access keys.

Running aws-mfa no longer performs the old MFA flow. It now prints a deprecation notice that detects your AWS CLI version and tells you how to switch.

Recommended workflow:

1. Make sure you have a recent AWS CLI installed (run aws --version). If aws login is unavailable, install or upgrade the AWS CLI per the docs: https://docs.aws.amazon.com/signin/latest/userguide/command-line-sign-in.html
2. Sign in with aws login and sign out with aws logout.
3. Because the new flow does not need permanent IAM access keys, remove your now-unused long-lived credentials:
   • Delete your IAM user's access keys in the AWS console (IAM → Users → your user → Security credentials → Access keys), or via aws iam delete-access-key --access-key-id <KEY_ID>.
   • Remove the stale access keys / *-mfa profiles from ~/.aws/credentials.

See the AWS docs for full details: https://docs.aws.amazon.com/signin/latest/userguide/command-line-sign-in.html

Scenario 2: SSO credentials — add-aws-profile is DEPRECATED

⚠️ add-aws-profile is deprecated. It was a paste helper: you copied the temporary credentials block from the AWS SSO start page ("Option 2: Add a profile to your AWS credentials file") and it pasted them into ~/.aws/credentials. Because those credentials expire, you had to re-paste them constantly.

Running add-aws-profile no longer performs the paste flow. It now prints a deprecation notice pointing you at the native AWS CLI SSO sign-in.

Recommended workflow:

1. Register your SSO profile once:

   aws configure sso

   (Use your SSO start URL, e.g. https://twentyideas.awsapps.com/start/, and pick the account/role when prompted.)
2. Sign in whenever you need credentials — this opens a browser and automatically refreshes temporary credentials, with no copy-paste:

   aws login        # or the equivalent: aws sso login

3. Remove the now-unused pasted profiles and access keys from ~/.aws/credentials.

See the AWS docs for full details: https://docs.aws.amazon.com/signin/latest/userguide/command-line-sign-in.html