provo

Provo SST-ready AWS accounts. One command from nothing to a verified ~/.aws/config profile.

Automates the SST per-stage account flow against the AWS APIs: create account, self-grant SSO admin, write SSO profile, verify, and print the SST snippet.

Not a landing-zone or governance tool. Never stores credentials. Uses the aws CLI's SSO token cache.

Requirements

• Node ≥ 20 and AWS CLI v2 (for aws sso login)
• An existing AWS Organization + IAM Identity Center (SSO), with a management-account profile and an admin permission set to grant

Already have those? Jump to Install. Otherwise, do the one-time bootstrap below first.

Starting from scratch (one-time)

provo only automates the repeatable part. Your AWS Organization and IAM Identity Center must exist first. Follow SST's full guide at https://sst.dev/docs/aws-accounts/, or use this checklist:

1. Sign up for your management account → https://portal.aws.amazon.com/billing/signup
2. Create an AWS Organization — search "AWS Organizations" in the console and click Create an organization
3. Enable IAM Identity Center — search for it, pick your Region first (it's permanent), then click Enable
4. Create a user + AdministratorAccess permission set under IAM Identity Center → Users
5. Assign the permission set to your management account under IAM Identity Center → AWS Accounts

When you can log in via your SSO URL and reach the AWS Console, run provo setup.

Install

npm install -g @quaddepos/provo   # installs the `provo` command
provo --help
# or run it without installing
npx @quaddepos/provo --help

Or build from source:

pnpm install
pnpm build      # → dist/cli.js
node dist/cli.js --help
# or during development
pnpm dev --help

Commands

provo setup — One-time setup. Discovers your Identity Center instance, permission set, and management profile and caches them to ~/.config/provo/config.json.

provo new [name] — Creates an account. Prompts for a name and root email, shows a review screen with an irreversibility warning, then runs the full flow: account creation, admin access grant, profile written to ~/.aws/config, verified, and the providers.aws.profile snippet printed for sst.config.ts. Bare provo aliases this.

Safety

• Resumable and idempotent, no local state. Re-run provo new with the same name and email after any interruption. Each step checks first and skips if already done (list-accounts, list-account-assignments, aws configure get). AWS is the source of truth and resumes correctly even across machines.
• aws configure set owns ~/.aws/config. provo never parses or rewrites your config by hand.

See ARCHITECTURE.md for full architecture and decisions.

Development

pnpm dev --help  # run from source via tsx
pnpm typecheck   # tsc --noEmit
pnpm check       # biome lint + format check
pnpm format      # biome format --write
pnpm build       # tsup → dist/