Support for AWS SSO? about awsprocesscreds

[obijan42]

It seems totally customer-hostile to have an AWS CLI not work with an AWS service. For every other (competing!) IDP there is support, but not for the AWS one.
Going to see if I can hack something together myself.

[drj42]

I'll echo the sentiments of @obijan42. I've wasted considerable time tonight trying to figure out how to auth on the cli without this copy/paste loop - which is just not practical for routine use. It didn't even occur to me that this impractical method would really be the only way to combine sso with the aws cli.

Its shocking to me that there isn't a CLI based auth flow for temporary credentials, and I think this is in direct tension with the advice we see in AWS documentation and from AWS personnel - which instructs us to avoid IAM users and long-lived access keys in favor of SSO, roles and rotating credentials in a multi account setup. Nothing makes me want to reach for long-lived access keys and IAM users more than this cumbersome alternate scenario.

At least one of AWS's competitors in the top-tier cloud provider space does it exactly right, out of the box, and has for years (Google it :P). This is a huge quality of life loser for AWS, I really hope you consider making it a higher priority.

[mattmcf]

For what it’s worth. The aws2 cli is now out in beta, which support aws sso commands and auth.

There’s also support for the aws sso service in some aws sdk’s now (ruby for example).

[ericvilla]

Hi @lorengordon, it's been a while since this issue is open but - as @mattmcf stated - AWS CLI v2 has support for AWS SSO, allowing you to log into your Portal URL, providing you AWS SSO User's credentials. Through the aws configure sso command you'll be able to create Named Profiles associated to the AWS IAM Roles you want to access, and that your user is allowed to access. For what concerns support to AWS SSO - IMO - the overall AWS CLI v2 user-experience could be improved, and that's what my team is trying to address. We're working on an Open Source project that manages credentials in your local-environment to access a complex Cloud Environment. If it makes sense to you, give a look at Leapp project

[JordonPhillips]

This is definitely something we're interested in supporting, but I can't give a specific timeline for when it will be ready.

[dan-lind]

+1

[drankard]

Any updates on this issue ??

[mattmcf]

+1

[pydemo]

It's a bit quirky (it opens browser) but it saves keys to file using python/selenium automation: automate-AWS-SSO

[nash-az]

+1

[jaroszan]

+1