MilkStraw CLI

The MilkStraw CLI (@milkstraw/cli) is a developer-friendly alternative to the web-based Quickstart. Use it to start or maintain your MilkStraw integration without leaving your terminal.

Prerequisites

An active MilkStraw AI account
The AWS CLI installed and configured
AWS credentials with access to your AWS Organization management account
The Engineer, Admin, or Owner role to run commands for an organization

Configure AWS credentials#

Set up credentials using one of:

aws configure      # Access key + secret
aws configure sso  # SSO login (recommended)

Verify your credentials are working:

aws sts get-caller-identity

Quick start#

Run setup to authenticate, setup and deploy the MilkStraw cross role through CloudFormation stacks into your AWS organization:

npx @milkstraw/cli setup

Commands#

Command	Description
`milkstraw login`	Interactive browser login
`milkstraw logout`	Revoke token and clear local auth
`milkstraw setup`	Complete onboarding and deploy stacks
`milkstraw status`	Check deployment status
`milkstraw update`	Update deployed stacks to latest templates
`milkstraw org list`	List accessible organizations

Inventory#

Command	Description
`milkstraw inventory ec2 list`	List EC2 on-demand instances
`milkstraw inventory rds list`	List RDS on-demand instances
`milkstraw inventory elasticache list`	List ElastiCache on-demand clusters
`milkstraw inventory opensearch list`	List OpenSearch on-demand clusters
`milkstraw inventory opensearch nodes list`	List OpenSearch nodes across all clusters
`milkstraw inventory eks list`	List EKS clusters
`milkstraw inventory eks nodegroups list`	List EKS node groups across all clusters
`milkstraw inventory ebs list`	List EBS volumes

Commitments#

Command	Description
`milkstraw commitments ec2 list`	List EC2 Reserved Instances
`milkstraw commitments rds list`	List RDS Reserved Instances
`milkstraw commitments elasticache list`	List ElastiCache Reserved Instances
`milkstraw commitments opensearch list`	List OpenSearch Reserved Instances
`milkstraw commitments savings_plans compute list`	List Compute Savings Plans
`milkstraw commitments savings_plans ec2_instance list`	List EC2 Instance Savings Plans
`milkstraw commitments savings_plans sage_maker list`	List SageMaker Savings Plans
`milkstraw commitments savings_plans database list`	List Database Savings Plans

Global options#

Option	Description
`--org <id>`	Specify organization ID
`--aws-profile <name>`	Override the AWS named profile
`--json`	Output as JSON
`--quiet`	Output data only
`--markdown`	Output as Markdown
`--verbose`	Enable verbose output
`--agent`	Agent-safe mode (no prompts, no spinners)

Environment variables#

Variable	Description
`MILKSTRAW_ORG`	Default organization ID
`MILKSTRAW_AWS_PROFILE`	Default AWS profile name

AWS credential resolution#

The CLI uses the AWS SDK for JavaScript v3 credential provider chain.

Without --aws-profile, credentials are resolved in this order:

Environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN
SSO token cache at ~/.aws/sso/cache
Shared credentials file at ~/.aws/credentials (default profile)
Shared config file at ~/.aws/config
ECS container or EC2 instance metadata

With --aws-profile <name> (or MILKSTRAW_AWS_PROFILE), the SDK skips environment variables and uses the named profile from ~/.aws/config and ~/.aws/credentials.

Authentication#

Tokens are stored at ~/.config/milkstraw-cli/token. Login uses the OAuth device code flow via your browser.

Run milkstraw logout at any time to revoke the token and clear local auth.

Tokens expire after 90 days. You can also revoke a token in the app: open Settings > Security, find the token under Access tokens, and click Revoke token.