4 ms·

This is murder to do for the command line. IAM users are the right choice for CLI. edit: apparently aws sso assists here!

avh02 6y ago
There is some tooling around this that makes it a little less painful, for example with okta i use a tool [0] that i only have to worry about once a day usually, and it's not as painful as okta's own tooling. However, it does require some understanding, standardization, and general competence from those around you as well. [0] - https://github.com/jmhale/okta-awscli https://github.com/jmhale/okta-awscli
- joombaga 6y ago
  I use this thing Nike made. Looks pretty similar. https://github.com/Nike-Inc/gimme-aws-creds https://github.com/Nike-Inc/gimme-aws-creds
0xEFF 6y ago
Is this a significant differentiator with GCP? I log into gcloud with the same identity used by the web console and the rest of Gsuite. I read the article and wondered why they don’t simply grant object access to a group of users using their existing identity, but I’m not as familiar with AWS as I am with GCP.
Xylakant 6y ago
For interactive cli use (that is: a person sitting at a computer), SSO is directly supported. `aws sso login ` pops up the web browser, starts the sso login flow and temporary credentials are issued for the cli. Has been working pretty neat for us.
- pnathan 6y ago
  I stand corrected, it seems like! Looks like it rolled out last Nov for the named profiles from the RSS feed. very happy to see work on this front!!
- orf 6y ago
  This doesn't work if you use OneLogin with IDP initiated login (and multiple accounts). Which sucks. We've had to write our own tooling, and you even need to use an extension like this[1] :( 1. https://chrome.google.com/webstore/detail/saml-to-aws-sts-keys-conv/ekniobabpcnfjgfbphhcolcinmnbehde?hl=en https://chrome.google.com/webstore/detail/saml-to-aws-sts-ke...
  - Xylakant 6y ago
    We used to use something similar (for office365/AzureAD), but the aws cli Version 2.0 in combination with the changes for aws sso late last year made that obsolete. You may want to check again if your case is now supported. I was pleasantly surprised, even though I had to do the saml setup dance again.
  - dastx 6y ago
    Have you considered saml2aws[0]? [0] https://github.com/Versent/saml2aws https://github.com/Versent/saml2aws

avh02 6y ago

There is some tooling around this that makes it a little less painful, for example with okta i use a tool [0] that i only have to worry about once a day usually, and it's not as painful as okta's own tooling. However, it does require some understanding, standardization, and general competence from those around you as well. [0] - https://github.com/jmhale/okta-awscli https://github.com/jmhale/okta-awscli

joombaga 6y ago
I use this thing Nike made. Looks pretty similar. https://github.com/Nike-Inc/gimme-aws-creds https://github.com/Nike-Inc/gimme-aws-creds

0xEFF 6y ago

Is this a significant differentiator with GCP? I log into gcloud with the same identity used by the web console and the rest of Gsuite. I read the article and wondered why they don’t simply grant object access to a group of users using their existing identity, but I’m not as familiar with AWS as I am with GCP.

Xylakant 6y ago

For interactive cli use (that is: a person sitting at a computer), SSO is directly supported. `aws sso login ` pops up the web browser, starts the sso login flow and temporary credentials are issued for the cli. Has been working pretty neat for us.

pnathan 6y ago
I stand corrected, it seems like! Looks like it rolled out last Nov for the named profiles from the RSS feed. very happy to see work on this front!!
orf 6y ago
This doesn't work if you use OneLogin with IDP initiated login (and multiple accounts). Which sucks. We've had to write our own tooling, and you even need to use an extension like this[1] :( 1. https://chrome.google.com/webstore/detail/saml-to-aws-sts-keys-conv/ekniobabpcnfjgfbphhcolcinmnbehde?hl=en https://chrome.google.com/webstore/detail/saml-to-aws-sts-ke...
- Xylakant 6y ago
  We used to use something similar (for office365/AzureAD), but the aws cli Version 2.0 in combination with the changes for aws sso late last year made that obsolete. You may want to check again if your case is now supported. I was pleasantly surprised, even though I had to do the saml setup dance again.
- dastx 6y ago
  Have you considered saml2aws[0]? [0] https://github.com/Versent/saml2aws https://github.com/Versent/saml2aws