# Command line and SDKs

The `shonin` command writes one AWS CLI profile for each permission set assigned to you. The AWS CLI, the SDKs, Terraform and CDK use them with no other setup, for 8 hours.

## Install

- macOS and Linux: `curl -fsSL https://shonin.ai/install.sh | sh`
- Windows (PowerShell): `irm https://shonin.ai/install.ps1 | iex`

The script checks the download against `SHA256SUMS`. Builds are also on https://shonin.ai/download.

## Sign in

```sh
shonin login <your Shonin org>
```

Your browser opens: confirm there, with your second factor. The profiles go in `~/.aws/config`, and their tokens in `~/.aws/shonin/<your Shonin org>/`. Profiles you no longer have are removed; other profiles are never touched.

- One account only: `shonin login <your Shonin org>/<account>` (see [Options](#options)).
- Without a browser (for example over SSH): in the portal, **Access keys** shows a command to paste.

```sh
aws s3 ls --profile <profile>
```

Run the same command again to renew them, after 8 hours or when you get a new permission set.

## Options

| Option | What it does |
|---|---|
| `<Shonin org>/<account>` or `--account <account>` | Only the profiles of that account, by name or ID. |
| `--permission-set <name>` | Only the profiles of that permission set. |
| `--profile <name>` | The name of the profile, when only one matches. |
| `--prefix <prefix>` | Profiles named `<prefix>-<account>-<permission set>` instead of `<Shonin org>-<account>-<permission set>`. |

`shonin version` shows the version; `shonin help` lists the commands.

## Roles you assume from a Shonin profile

A Shonin profile works as `source_profile` for other roles that trust it with `sts:AssumeRole`:

```ini
[profile production-admin]
source_profile = acme-staging-Developer
role_arn = arn:aws:iam::111122223333:role/Admin
```

## Temporary credentials

For a single shell, **Access keys** in the portal shows credentials valid one hour: see [Console access](console-access.md).

## AI coding agents

At the first sign-in `shonin` offers to install a skill for AI coding agents (Claude Code, Kiro and the agents that read `~/.agents/skills`): when AWS access expires, the agent suggests the `shonin login` command of that profile. It never runs it, never reads your tokens, and never asks for codes. `shonin skills install` and `shonin skills remove` change it later.

Ask the agent to update shonin: it installs the latest command and its skill together.

## Update

Run the install command again: it replaces the command with the latest build.