CLI Usage

Runs a command with temporary AWS credentials injected into its environment. The child process receives AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN automatically.

Everything after -- is the command (and its arguments) to run. The credentials expire after the TTL, even if the command is still running.

Prints export or unset statements for AWS credential environment variables. Wrap the call with eval to apply them to your current shell session.

Set credentials:

Clear credentials:

The --unset flag prints unset statements for AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN, letting you clean up after you are done.

Scopes follow the format service:level where level is ro (read-only) or full (read + write). You can pass multiple scopes as a comma-separated list or with repeated -s flags.

Comma-separated:

Repeated flags:

Both forms are equivalent. Use whichever is more readable for your use case.

A script can acquire its own credentials by checking for an existing session and re-executing itself through timebound-iam exec when one is missing. This makes deploying a single ./deploy.sh call.

#!/bin/bash
set -e

# Self-wrap: if no session credentials, re-exec through timebound-iam
if [ -z "$AWS_SESSION_TOKEN" ]; then
    exec timebound-iam exec \
        -s s3:full,cloudfront:full \
        -t 30m \
        --profile prod \
        --no-confirm \
        -- "$0" "$@"
fi

# From here on, AWS credentials are in the environment
aws s3 sync dist/ s3://my-bucket --delete
aws cloudfront create-invalidation \
    --distribution-id E1234567890 \
    --paths "/*"

On the first run, $AWS_SESSION_TOKEN is unset, so the script calls exec timebound-iam exec ... -- "$0" "$@" which replaces the current process with itself under temporary credentials. On the second invocation, the token exists and the script falls through to the actual work.

Both exec and env share the following flags:

The env subcommand has one additional flag: