shonindocs

Use AWS

Command line and SDKs

The shonin command writes one AWS CLI profile for each permission set assigned to you. The AWS CLI, the SDKs, Terraform and CDK use them with no other setup, for 8 hours.

#Install

  • macOS and Linux: curl -fsSL https://shonin.ai/install.sh | sh
  • Windows (PowerShell): irm https://shonin.ai/install.ps1 | iex

The script checks the download against SHA256SUMS. Builds are also on https://shonin.ai/download.

#Sign in

shonin login <your Shonin org>

Your browser opens: confirm there, with your second factor. The profiles go in ~/.aws/config, and their tokens in ~/.aws/shonin/<your Shonin org>/. Profiles you no longer have are removed; other profiles are never touched.

  • One account only: shonin login <your Shonin org>/<account> (see Options).
  • Without a browser (for example over SSH): in the portal, Access keys shows a command to paste.
aws s3 ls --profile <profile>

Run the same command again to renew them, after 8 hours or when you get a new permission set.

#Options

Option What it does
<Shonin org>/<account> or --account <account> Only the profiles of that account, by name or ID.
--permission-set <name> Only the profiles of that permission set.
--profile <name> The name of the profile, when only one matches.
--prefix <prefix> Profiles named <prefix>-<account>-<permission set> instead of <Shonin org>-<account>-<permission set>.

shonin version shows the version; shonin help lists the commands.

#Roles you assume from a Shonin profile

A Shonin profile works as source_profile for other roles that trust it with sts:AssumeRole:

[profile production-admin]
source_profile = acme-staging-Developer
role_arn = arn:aws:iam::111122223333:role/Admin

#Temporary credentials

For a single shell, Access keys in the portal shows credentials valid one hour: see Console access.

#AI coding agents

At the first sign-in shonin offers to install a skill for AI coding agents (Claude Code, Kiro and the agents that read ~/.agents/skills): when AWS access expires, the agent suggests the shonin login command of that profile. It never runs it, never reads your tokens, and never asks for codes. shonin skills install and shonin skills remove change it later.

Ask the agent to update shonin: it installs the latest command and its skill together.

#Update

Run the install command again: it replaces the command with the latest build.

View as Markdown