cloudsesame

Appearance

Getting started ​

cloudsesame makes sure you're online and logged in to your clouds (gcloud, aws, az) before you work, and logs you in when you're not. Run it by hand, before dev, before infra commands, or in CI.

$ bunx cloudsesame infra
✔ online
✖ gcloud user  me@acme.dev  reauthentication required
  → gcloud auth login --update-adc
✔ gcloud adc
✔ gcloud quota project  acme-billing
✔ aws prod  arn:aws:sts::222222222222:assumed-role/Admin/me

? gcloud isn't ready.
❯ Log in (l)  gcloud auth login --update-adc
  Skip (s)
  Stop (x)

1. Run it ​

sh
bunx cloudsesame        # or: npx cloudsesame

With no config, it checks every cloud CLI you have installed with default settings. For each one that isn't ready, it asks:

  • Log in runs the provider's login (e.g. gcloud auth login --update-adc), then checks again.
  • Skip carries on without that provider.
  • Stop exits with code 5.

See Installation for Homebrew, Scoop, Chocolatey and standalone binaries.

2. Add a config ​

sh
bunx cloudsesame init   # writes sesame.config.ts from your installed CLIs

init picks up your current gcloud project, AWS profile and Azure subscription. Edit the file to keep only what the project needs, and add the accounts and projects you expect:

ts
// sesame.config.ts
import type { Config } from "cloudsesame";

export default {
  gcloud: { credentials: "adc", project: "acme-dev" },
  aws: { profile: "dev" },
} satisfies Config;

Commit it: it holds no secrets. All options are in Configuration.

3. Wire it into your scripts ​

json
{
  "scripts": {
    "predev": "cloudsesame predev"
  }
}
json
{
  "scripts": {
    "auth": "cloudsesame infra",
    "plan": "cloudsesame infra && tofu plan"
  }
}

predev checks connectivity first (offline: continue with a warning, or stop), then each provider (log in, skip, or stop). Skipping is fine: dev still starts.

cloudsesame infra runs auth for a group. With groups: { infra: ["gcloud", "aws"] } in the config, it makes sure both are logged in, including gcloud Application Default Credentials, which OpenTofu/Terraform use.

4. CI and agents ​

Without a terminal, cloudsesame can't prompt, so anything that would prompt fails with exit code 4 and tells you exactly what to run:

✖ Not ready: aws dev
  No terminal to prompt in. Run `aws sso login --profile dev`, or rerun with --skip to continue without it.

Pass --skip to continue anyway, or set noTerminal: "skip" in the config. Use cloudsesame check --json for machine-readable status. More in CI and AI agents.

Next steps ​

ConfigurationEvery option, with defaults.Commandsauth, predev, check, init, flags and exit codes.ProvidersWhat each provider checks and the fixes it offers.RecipesConfigs for common setups, ready to copy.