devops-infra MCP Server
Keep Claude Code sessions alive through AWS credential expiry
Discovered via github-topic:mcp and last synced 3mo ago.
Install instructions not detected yet
Check the source repository for the latest setup steps.
Auto-run `autoLoginCmd` when session has fewer than this many minutes left (0 = disabled). Requires `expirationField`. Rate-limited to once per 5 minutes
`awsmyid_session_expiration`
Purpose
Fix
AWS profile name in `~/.aws/credentials`
Command for fully automated re-authentication. Must work without a TTY — see [Auto-login setup](#auto-login-setup) below
`x_security_token_expires`
Minutes before expiry to turn the statusline timer red
Description
`x_security_token_expires`
Field storing session expiration as unix timestamp. Leave empty to fall back to `aws sts get-caller-identity` (slower, can only detect expired vs. valid — not time remaining)
Existing status line command to compose with (leave empty for standalone)
`expirationField` value
Timeout per sync operation in seconds (default: 15). Uses seconds (not minutes) because sync operations complete in seconds, unlike session lifetimes
Remote credentials file path (default: `~/.aws/credentials`)
HTTP method (default: `POST`)
Shell command to execute (required)
### How it works **Before expiry (proactive):** 1. You submit a prompt in Claude Code 2. The `UserPromptSubmit` hook checks credential expiration 3. If nearing expiry and `autoLoginCmd` is configured: fires it in the background (you get a notification, approve MFA, session renews silently) 4. If nearing expiry without `autoLoginCmd`: inline warning with re-auth command 5. If expired: warns inline — the prompt proceeds and `awsAuthRefresh` handles recovery **After expiry (reactive):** 1. Claude Code hits a Bedrock 403 2. `awsAuthRefresh` runs — checks if you already re-authed in another terminal 3. If still expired and `autoLoginCmd` is configured, runs it synchronously (waits up to 3 minutes for password + MFA) 4. `awsCredentialExport` reads fresh creds from disk (bypassing SDK memory cache) 5. Claude Code retries the API call — session continues without restart ### The key insight Claude Code's AWS SDK caches credentials in memory and doesn't re-read `~/.aws/credentials` after expiry ([known issue](https://github.com/anthropics/claude-code/issues/41064)). The `awsCredentialExport` setting forces Claude Code to call our script instead, which always reads the latest credentials from disk. ## Install Requires Node.js (ships with Claude Code). ### Option A: As a Claude Code plugin (recommended) ```bash # Add the marketplace to your settings.json: # "extraKnownMarketplaces": { # "cc-aws-keepalive": { # "source": { "source": "git", "url": "https://github.com/GeiserX/cc-aws-keepalive.git" } # } # } # # Then enable the plugin: # "enabledPlugins": { "cc-aws-keepalive@cc-aws-keepalive": true } ``` The plugin auto-registers the `UserPromptSubmit` hook. You still need to add `awsCredentialExport` and `awsAuthRefresh` to `~/.claude/settings.json` — point them at the cached plugin path: ```json { "awsCredentialExport": "node ~/.claude/plugins/cache/cc-aws-keepalive/cc-aws-keepalive/<version>/aws-cred-export.mjs", "awsAuthRefresh": "node ~/.claude/plugins/cache/cc-aws-keepalive/cc-aws-keepalive/<version>/aws-auth-refresh.mjs" } ``` Replace `<version>` with the installed version (e.g., `0.3.0`). Then create and edit your config: ```bash cp config.example.json ~/.config/cc-aws-keepalive/config.json ``` ### Option B: Manual (no plugin system) ```bash git clone https://github.com/GeiserX/cc-aws-keepalive.git cd cc-aws-keepalive node install.mjs ``` The installer creates a config and prints all settings to add to `~/.claude/settings.json`. ### Upgrading After upgrading, re-run the installer to update paths: - **Plugin**: `node ~/.claude/plugins/cache/cc-aws-keepalive/cc-aws-keepalive/<version>/install.mjs` - **Manual**: `git pull && node install.mjs` The installer automatically: 1. **OMC HUD wrapper**: Cleans up any legacy timer patch from `omc-hud.mjs` and updates the `aws-hud-wrapper.mjs` with the current path 2. **settings.json paths**: Updates `awsCredentialExport` and `awsAuthRefresh` to point to the new version directory (preserves any custom wrapper commands) ## Configure Edit `~/.config/cc-aws-keepalive/config.json`: ```json { "profile": "my-bedrock-profile", "expirationField": "x_security_token_expires", "loginCmd": "saml2aws login --profile my-bedrock-profile", "autoLoginCmd": "", "autoLoginMinutes": 30, "warnMinutes": 30, "timerWarnMinutes": 60, "statusLineCmd": "" } ```
Command to re-authenticate (shown in warnings so you can copy-paste it)
Minutes before expiry to start showing warnings
Overrides `profile` from config. Useful for multi-account setups where different terminals use different AWS accounts
`x_security_token_expires`
Logged in} { puts "Auto-login succeeded" } eof {} timeout { puts stderr "auto-login timed out after 180s" exit 1 } } set result [wait] exit [lindex $result 3] ``` Save it to `~/.config/cc-aws-keepalive/auto-login.exp` and make it executable: ```bash chmod +x ~/.config/cc-aws-keepalive/auto-login.exp ``` **Test it manually first:** ```bash # This should complete the full login without any manual input expect ~/.config/cc-aws-keepalive/auto-login.exp my-profile ``` If it hangs, run with `log_user 1` (change line 4) to see what the tool is outputting — often it's an unexpected prompt or ANSI escape codes breaking the pattern match. ### Step 3: Configure cc-aws-keepalive Update your `~/.config/cc-aws-keepalive/config.json`: ```json { "profile": "my-bedrock-profile", "expirationField": "x_security_token_expires", "loginCmd": "saml2aws login --profile my-bedrock-profile", "autoLoginCmd": "expect ~/.config/cc-aws-keepalive/auto-login.exp my-bedrock-profile", "autoLoginMinutes": 30, "warnMinutes": 30, "timerWarnMinutes": 60, "statusLineCmd": "" } ``` Key points: - `autoLoginCmd` is the full command — it must work when run as `sh -c "your command"` with no TTY - `autoLoginMinutes` controls how early the proactive trigger fires (30 = re-auth when 30 minutes remain) - `loginCmd` is still shown in manual warnings as a fallback — it's never run automatically ### Common pitfalls
Description
Array of sync targets (empty = disabled)
Minimum seconds between syncs (default: 60)
Remote hostname (required)
SSH username (optional — uses SSH config default)
Profile name in the JSON payload (default: same as local `profile`)
Additional SSH arguments as a string or array (optional). Use array form for paths with spaces: `["-i", "/path/to/key"]`
Password for `sshpass` auth (optional — prefer key-based auth)
HTTPS endpoint (required — HTTP refused)
Custom headers; supports `${ENV_VAR}` interpolation (optional)
Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.
Implement Amazon Macie to automatically discover, classify, and protect sensitive data in S3 buckets using machine learning and pattern matching for PII, financial data, and credentials detection.
Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity.
Implementing AWS Security Hub to aggregate security findings across AWS accounts, enable compliance standards like CIS AWS Foundations and PCI DSS, configure automated remediation with EventBridge and Lambda, and create custom security insights for organizational risk management.
Flexible and powerful framework for managing multiple AI agents and handling complex conversations
为独立开发者准备的精选技术栈和工具仓库来了！这里有你最需要的工具，帮你提升开发效率、节约成本，最重要的是——这些工具都是市场上热门的，经过验证的。🚀A curated collection of tech stacks and tools tailored for independent developers is here! these are proven, popular tools widely used in the industry. 🚀
Learn Cloud Applied Generative AI Engineering (GenEng) using OpenAI, Gemini, Streamlit, Containers, Serverless, Postgres, LangChain, Pinecone, and Next.js
The secure gateway connecting AI agents to enterprise systems.
Learn how to use the cloud-aws Claude skill. Complete guide with installation instructions and examples.
Learn how to use the detecting-aws-iam-privilege-escalation Claude skill. Complete guide with installation instructions and examples.
Learn how to use the detecting-aws-guardduty-findings-automation Claude skill. Complete guide with installation instructions and examples.