claude-aws-mfa 1.4.0 → 1.5.0

package/CHANGELOG.md

@@ -22,6 +22,11 @@ Releases are automated via CI. To create a new release:
 Stable versions (e.g. `v1.2.0`) publish to npm `@latest`. Pre-release versions
 (e.g. `v1.2.0-rc.1`) publish to npm `@next` and create a GitHub pre-release.
 
+## [v1.5.0] - 2026-10-19
+
+### Added
+- `AWS_REGION`, when set, overrides the configured region for STS and `--usage`, so a report can target a region other than the one in the config.
+
 ## [v1.4.0] - 2026-10-19
 
 ### Added

package/README.md

@@ -58,6 +58,8 @@ Add this (plus any addtitional config you prefer) to your Claude Code settings (
 6. Saves configuration (including MFA mode and command) to `~/.config/claude-aws-mfa.json` (mode 0600) for subsequent runs
 7. Outputs temporary credentials as JSON to stdout
 
+If `AWS_REGION` is set, it overrides the configured region for all AWS calls (STS and `--usage`); the saved config is left unchanged. When Claude Code runs the tool, it sees whatever `AWS_REGION` Claude Code's environment has (including one set in `settings.json`); when you run it yourself from a shell, it only sees your shell's.
+
 On subsequent runs, all fields are pre-populated from the saved config — just enter a fresh MFA code and hit OK. If you use the command mode, the TOTP code is fetched automatically so no manual entry is needed at all.
 
 ### Claude Code profiles
@@ -119,7 +121,7 @@ claude-aws-mfa --usage='my-role/*'                         # quote * so the shel
 
 Only callers that assumed a role are counted; calls made directly with IAM user keys never match.
 
-The data comes from Bedrock [model invocation logs](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html), so invocation logging to CloudWatch Logs must be enabled in the account and region. The querying credentials need `bedrock:GetModelInvocationLoggingConfiguration`, `logs:StartQuery` and `logs:GetQueryResults`. Without `--profile`, credentials are obtained exactly as for Claude Code (cached session, auto-MFA, or the dialog). Errors go to stderr.
+Only one region is queried: `AWS_REGION` if set, otherwise the configured region. If your Claude Code `settings.json` sets `AWS_REGION` to something other than the configured region, pass the same value when running `--usage` from a shell (`AWS_REGION=eu-west-1 claude-aws-mfa --usage`) to report on the region Claude Code uses. Cross-region inference calls (`us.`/`global.` profiles) are logged in the region they were made from, so they are included. The data comes from Bedrock [model invocation logs](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html), so invocation logging to CloudWatch Logs must be enabled in the account and region. The querying credentials need `bedrock:GetModelInvocationLoggingConfiguration`, `logs:StartQuery` and `logs:GetQueryResults`. Without `--profile`, credentials are obtained exactly as for Claude Code (cached session, auto-MFA, or the dialog). Errors go to stderr.
 
 Costs are estimated from AWS's public [Price List](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/price-changes.html) for the region (no extra permissions needed), at current base on-demand rates — `us.`/`eu.` cross-region profiles at their geo price, `global.` at the global price. They exclude negotiated discounts and the long-context and 1-hour-cache-write surcharges, which the aggregated logs can't distinguish, so treat them as an estimate rather than your bill. If prices can't be fetched, token counts are still printed.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-aws-mfa",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "type": "module",
   "repository": "https://github.com/aaronmeriwether/claude-aws-mfa",
   "bin": {

package/src/config.ts

@@ -259,6 +259,15 @@ export function missingConfigFields(cfg: Partial<Config>): string[] {
   return missing;
 }
 
+/**
+ * Region for AWS calls: AWS_REGION, when set, overrides the configured one, as
+ * it does for the AWS SDK and CLI. Only applied at call time — the config keeps
+ * the region entered in the dialog.
+ */
+export function effectiveRegion(configured?: string): string | undefined {
+  return process.env.AWS_REGION || configured || undefined;
+}
+
 export async function seedDefaults(): Promise<Partial<Config>> {
   const defaults: Partial<Config> = {};
   try {

package/src/sts.ts

@@ -1,4 +1,5 @@
 import { STSClient, AssumeRoleCommand } from "@aws-sdk/client-sts";
+import { effectiveRegion } from "./config";
 
 export const DEFAULT_SESSION_NAME = "claude-aws-mfa";
 
@@ -30,7 +31,7 @@ export async function assumeRoleWithMfa(params: {
   sessionName?: string;
 }) {
   const client = new STSClient({
-    region: params.region,
+    region: effectiveRegion(params.region),
     credentials: { accessKeyId: params.accessKeyId, secretAccessKey: params.secretAccessKey },
   });
 

package/src/usage.ts

@@ -1,6 +1,7 @@
 import { BedrockClient, GetModelInvocationLoggingConfigurationCommand } from "@aws-sdk/client-bedrock";
 import { CloudWatchLogsClient, StartQueryCommand, GetQueryResultsCommand } from "@aws-sdk/client-cloudwatch-logs";
 import { DEFAULT_SESSION_NAME } from "./sts";
+import { effectiveRegion } from "./config";
 
 const COLUMNS = ["requests", "inputTokens", "cacheReadTokens", "cacheWriteTokens", "outputTokens"] as const;
 const HEADERS = ["Model", "Requests", "Input", "Cache read", "Cache write", "Output"];
@@ -190,7 +191,7 @@ export async function printUsage(opts: {
   const { start, end } = usageRange(opts.from, opts.to);
   const specText = opts.spec || DEFAULT_SESSION_NAME;
   const spec = parseUsageSpec(specText);
-  const clientConfig = { region: opts.region || undefined, credentials: opts.credentials, profile: opts.profile };
+  const clientConfig = { region: effectiveRegion(opts.region), credentials: opts.credentials, profile: opts.profile };
 
   const bedrock = new BedrockClient(clientConfig);
   // Prices are best-effort: token counts are still worth printing without them.

package/test/config.test.ts

@@ -3,7 +3,25 @@ import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, rmSync,
 import { join, resolve } from "path";
 import { tmpdir } from "os";
 import { homedir } from "os";
-import { activeProfile, missingConfigFields, profileSuffix } from "../src/config";
+import { activeProfile, effectiveRegion, missingConfigFields, profileSuffix } from "../src/config";
+
+describe("effectiveRegion", () => {
+  test("AWS_REGION overrides the configured region", () => {
+    const saved = process.env.AWS_REGION;
+    try {
+      delete process.env.AWS_REGION;
+      expect(effectiveRegion("us-west-2")).toBe("us-west-2");
+      expect(effectiveRegion(undefined)).toBeUndefined();
+      process.env.AWS_REGION = "eu-central-1";
+      expect(effectiveRegion("us-west-2")).toBe("eu-central-1");
+      process.env.AWS_REGION = "";
+      expect(effectiveRegion("us-west-2")).toBe("us-west-2");
+    } finally {
+      if (saved === undefined) delete process.env.AWS_REGION;
+      else process.env.AWS_REGION = saved;
+    }
+  });
+});
 
 describe("profileSuffix", () => {
   test("is empty for no profile and for the default config dir", () => {