Command line

gatekeeper does from a terminal what the dashboard does in a browser: signs you in, then puts credentials for a client account into your shell.

If you use AWS from the command line at all, this is worth the two minutes to install. It renews your session in the background, so you stop going back to the browser every hour.

Install

curl -fsSL https://gatekeeper.gcd.tech/install.sh | bash
exec $SHELL
gatekeeper login

The installer adds a small hook to your shell config and needs Node.js 24 or newer. Re-run it any time to upgrade — it won't duplicate anything — or use gatekeeper self-update.

gtkpr is installed alongside as a shorter alias. Both do exactly the same thing.

Connecting

gatekeeper connect acme-prod

That's it — your shell now has credentials for that account, and aws, terraform and anything else that reads the standard environment variables will use them.

Tab completion works on account names. You can type the display name ("Acme Prod"), the slug (acme-prod), or the 12-digit account id; whichever is convenient.

Once connected, your prompt carries a badge on the right showing the account and permission, coloured by risk — red for Administrator, yellow for PowerUser, green for ReadOnly. It's there because a shell doesn't otherwise look any different when it's pointed at a client's production account. If you'd rather not have it, set GK_NO_PROMPT=1.

Useful variations

Command	Does
`gatekeeper connect acme-prod --permission ReadOnly`	Ask for less than your maximum
`gatekeeper connect acme-prod --console`	Open the AWS console instead
`gatekeeper accounts`	List the accounts you can reach
`gatekeeper -v`	Version, and which deployment it points at
`gatekeeper logout`	Sign out and delete local credentials

Long-running work

The one-hour limit applies to the credentials themselves, so a terraform apply that runs past the hour will lose them mid-run. For that, wire up a profile instead:

# ~/.aws/config
[profile acme-prod]
credential_process = gatekeeper credentials acme-prod

Then aws --profile acme-prod ... or AWS_PROFILE=acme-prod terraform apply. The AWS tooling calls gatekeeper itself whenever the credentials expire, so long jobs keep going without you doing anything.

Where things are kept

~/.gatekeeper/ holds your session and a Google token, readable only by you. gatekeeper logout removes them properly — it also tells Google to forget the sign-in, which deleting the folder by hand doesn't do.