About a year ago, I migrated my team's AWS access from manually-provisioned AWS keys to GSuite authentication, using a combination of SAML and OpenID Connect (O

About a year ago, I migrated my team's AWS access from manually-provisioned AWS keys to GSuite authentication, using a combination of SAML and OpenID Connect (OIDC): - Detailed instructions for Google-federated login to the AWS Management Console through SAML are available [1], and worked more or less as described. - CLI/API access is a bit trickier and less thoroughly documented, but is possible using the 'Web Identity Federation' feature [2]. Basically, you generate/refresh temporary AWS credentials by passing a Google OIDC token to the AssumeRoleWithWebIdentity API. The tricky part is keeping both your Google OIDC and AWS STS tokens conveniently refreshed. I wrote some open-source glue code for this that hooks into the AWS Ruby SDK and CLI [3]. It's still a little rough around the edges and not yet extracted into a standalone project, but it's been working well enough for my team over the last year. [1] https://aws.amazon.com/blogs/security/how-to-set-up-federated-single-sign-on-to-aws-using-google-apps/ https://aws.amazon.com/blogs/security/how-to-set-up-federate... [2] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr... [3] https://github.com/code-dot-org/code-dot-org/blob/staging/lib/cdo/aws/google_credentials.rb https://github.com/code-dot-org/code-dot-org/blob/staging/li...