diff --git a/pkgs/tools/admin/aws-auth/default.nix b/pkgs/tools/admin/aws-auth/default.nix
new file mode 100644
index 00000000000..6d03a95d96a
--- /dev/null
+++ b/pkgs/tools/admin/aws-auth/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, makeWrapper, jq, awscli }:
+
+stdenv.mkDerivation rec {
+  version = "unstable-2017-07-24";
+  name = "aws-auth-${version}";
+
+  src = fetchFromGitHub {
+    owner = "alphagov";
+    repo = "aws-auth";
+    rev = "5a4c9673f9f00ebaa4bb538827e1c2f277c475e1";
+    sha256 = "095j9zqxra8hi2iyz0y4azs9yigy5f6alqkfmv180pm75nbc031g";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  phases = [ "installPhase" ];
+
+  # copy script and set $PATH
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $src/aws-auth.sh $out/bin/aws-auth
+    wrapProgram $out/bin/aws-auth --prefix PATH : ${awscli}/bin:${jq}/bin
+  '';
+
+  meta = {
+    homepage = https://github.com/alphagov/aws-auth;
+    description = "AWS authentication wrapper to handle MFA and IAM roles";
+    license = stdenv.lib.licenses.mit;
+    maintainers = with stdenv.lib.maintainers; [ ris ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e673ecde6dd..7c26ba7c826 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -511,6 +511,8 @@ with pkgs;
 
   awless = callPackage ../tools/virtualization/awless { };
 
+  aws-auth = callPackage ../tools/admin/aws-auth { };
+
   ec2_api_tools = callPackage ../tools/virtualization/ec2-api-tools { };
 
   ec2_ami_tools = callPackage ../tools/virtualization/ec2-ami-tools { };