Merged
Conversation
afalahi
commented
Mar 29, 2026
Contributor
Author
afalahi
left a comment
afalahi
left a comment
There was a problem hiding this comment.
lgtm. tested locally and everything works
Fix GetResource interface parameter order to match implementation. Add UpdateEntitlement method to C1Client interface. Add IsAWSPermissionSet detection in task.go. Add output.JSON constant for format checks.
Add `cone aws setup` — configures SSO URL and regions, scans ConductorOne for AWS permission set entitlements, and creates ~/.aws/config profiles with credential_process pointing to cone. Add `cone aws credentials` — fetches temporary AWS credentials via SSO. Automatically submits a ConductorOne access request if no active grant exists, polls for auto-approval, and retries SSO login on expired tokens. Add `cone aws setup show` — displays current SSO configuration.
checkC1Access was building a fake cobra.Command with hardcoded flags just to call cmdContext() for a client. Since awsCredentialsRun already has a client from cmdContext, pass it through instead. Also add requireAWSCLI() check before shelling out to aws, so users get a clear error message instead of an exec failure.
robert-chiniquy
approved these changes
Mar 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cone aws setup— configures SSO URL/regions, scans ConductorOne for AWS permission set entitlements, creates~/.aws/configprofiles withcredential_processpointing to conecone aws credentials <profile>— fetches temporary AWS credentials via SSO, auto-submits access requests if no active grant, polls for auto-approval, retries SSO login on expired tokenscone aws setup show— displays current SSO configuration--sso-region(Identity Center) from--region(default AWS CLI region)Usage
Test plan
cone aws setup --sso-url <url> --sso-region <region>creates profiles in ~/.aws/configcone aws setup showdisplays saved configcone aws setup(re-run) skips existing profilescone aws credentials <profile>returns JSON credentials when grantedcone aws credentials <profile>auto-submits request when no grant existsaws sso loginand retryaws <command> --profile <name>works end-to-end via credential_process