Overwrite the aws config instead of appending

README.md

@@ -4,7 +4,9 @@ Obtain temporary AWS Creds from your Okta Profile.
 
 ## Usage
 
-Here's an example. All options are required except `okta_mfa_method` which default to TOTP based notification.
+Here's an example. All options are required except:
+- `aws_profile` defaults to 'default'
+- `okta_mfa_method` which default to TOTP based notification.
 
 ```yaml
 - name: Create AWS profile
@@ -27,6 +29,35 @@ AWS_SESSION_TOKEN: ***
 
 It also masks the actual values in the logs for added security.
 
+
+You can create multiple profiles by using this action multiple times and specifying `aws_profile` for each like such:
+```yaml
+- name: Create First AWS profile
+  uses: mrchief/aws-creds-okta@master
+  with:
+    aws_profile: first-profile
+    aws_role_arn: arn:aws:iam::account-id:role/role-name
+    okta_username: [email protected]
+    okta_password: ${{ secrets.OKTA_PASSWORD }}
+    okta_app_url: https://mycompany.okta.com/home/amazon_aws/1234567890abcdefghij/123
+    okta_mfa_seed: ${{ secrets.OKTA_MFA_SEED }}
+
+- name: Create Second AWS profile
+  uses: mrchief/aws-creds-okta@master
+  with:
+    aws_profile: second-profile
+    aws_role_arn: arn:aws:iam::account-id:role/role-name
+    okta_username: [email protected]
+    okta_password: ${{ secrets.OKTA_PASSWORD }}
+    okta_app_url: https://mycompany.okta.com/home/amazon_aws/1234567890abcdefghij/123
+    okta_mfa_seed: ${{ secrets.OKTA_MFA_SEED }}
+
+- name: Run AWS Commands as Different Profiles
+  run: |
+    aws sts get-caller-identity --profile first-profile
+    aws sts get-caller-identity --profile second-profile
+```
+
 ### 💡 Note
 
 - Currently only supports `totp` authentication. There are plans to add support for other MFA methods. PRs welcome.

action.yml

@@ -4,6 +4,10 @@ inputs:
   aws_role_arn:
     description: "ARN of federated Okta role"
     required: true
+  aws_profile:
+    description: "The AWS profile to configure"
+    required: false
+    default: "default"
   okta_username:
     description: "Username of your Okta login (usually your email)"
     required: true

entrypoint.sh

@@ -8,15 +8,15 @@ config="${awsDir}/config"
 credentials="${awsDir}/credentials"
 
 mkdir -p "${awsDir}"
-echo -e "[profile default]\noutput = json" >>"$config"
+echo -e "[profile $INPUT_AWS_PROFILE]\noutput = json" >>"$config"
 
 # Attempt to get aws credentials via tokendito
 max_attempts=10
 totp_time=30
 totp_error='Each code can only be used once. Please wait for a new code and try again.'
 for ((attempts = 1; attempts <= $max_attempts; attempts++)); do
     echo "Requesting AWS credentials via Tokendito."
-    t_error=$(tokendito --aws-profile default -ou $INPUT_OKTA_APP_URL -R $INPUT_AWS_ROLE_ARN --username $INPUT_OKTA_USERNAME --password $INPUT_OKTA_PASSWORD --mfa-method ${INPUT_OKTA_MFA_METHOD:=token:software:totp} --mfa-response $(echo $INPUT_OKTA_MFA_SEED | mintotp ${totp_time}) 2>&1 1>/dev/null)
+    t_error=$(tokendito --aws-profile $INPUT_AWS_PROFILE -ou $INPUT_OKTA_APP_URL -R $INPUT_AWS_ROLE_ARN --username $INPUT_OKTA_USERNAME --password $INPUT_OKTA_PASSWORD --mfa-method ${INPUT_OKTA_MFA_METHOD:=token:software:totp} --mfa-response $(echo $INPUT_OKTA_MFA_SEED | mintotp ${totp_time}) 2>&1 1>/dev/null)
 
     if [[ $? == 0 ]]; then
         echo "Succeeded getting credentials in attempt #${attempts}."