The following reconfiguration has been identified as part of the preparation needed to perform the upgrade to Okta Identity Engine (OIE). Note that additional Okta features may require reconfiguration or be disabled in order to complete the upgrade. This article addresses an issue where community-developed tools that use the Amazon Web Services (AWS) Command Line Interface (CLI), such as gimme-aws-creds and saml2aws, stop functioning after an upgrade to Okta Identity Engine (OIE).
- Okta Identity Engine Upgrade
- Amazon Web Services Federation
- Amazon Web Services Command Line Interface
- USER_AGENT
Community-developed AWS CLI tools were created using classic authentication methods via the /authn API, which are incompatible with the controls and constraints enforced by OIE.
To determine if these tools are in use, search the System Log using the following queries:
-
"gimme-aws-creds"
-
“saml2aws"
-
"aws_okta_keyman"
-
"okta-awscli"
-
"fsdpt-cli"
-
"aws-login-tool"
To maintain CLI access after the upgrade, choose one of the following options:
-
Switch to the Okta AWS CLI application after upgrading to OIE. This application is built for the OIE framework and is compatible with its policies and access controls. The command line user experience is similar to the community created in regards to the user interface; however, it will be compatible with Okta Identity Engine policies and access controls as it is associated to an additional OIDC application. For the latest information, refer to the okta-aws-cli on the Okta GitHub.
NOTE: The okta-aws-cli application requires the OIE policy framework and cannot be fully tested in classic environments. Continue using the current solution until the upgrade is complete. To test the workstation configuration before the upgrade, refer to Testing okta-aws-cli before upgrade.
-
Switch to the AWS Identity and Access Management (IAM) Identity Center before upgrading to OIE. This web-based interface provides access to the Management console, which includes the Account/Role Picker and access via the Browser Embedded CLI. More information: AWS IAM Identity Center or AWS User Guide for Configuring Okta and IAM Identity Center
