Package: alohomora
alohomoraalohomora is a CLI utility, written in Python, that helps SAML-federated users
get API keys for their AWS accounts.  It works with single-factor IdPs in
general, and also supports multi-factor viaDuo Security.
We'd love to support other MFA options, but that's all we have access to right
now.  Send us a PR with yours!InstallationLike all Python apps, we recommend you install this into a virtual environment,
but the choice is yours.pip install alohomoraOptional WebAuthN support installationAlohomora has optional Fido2/WebAuthN support which can be installed alongside alohomora using pip:pip install alohomora[fido2]Please note that this may require a few OS level packages to be installed due to the transitive
dependency on the cryptography package. See theinstallation guidefor instructions specific to your environment.Basic ConfigurationYou can create a ~/.alohomora file to configure the tool.  It will store
infomation like the URL of your SAML Identity Provider that shouldn't change
very often.  Alternately, you can specify most config options on the command
line as well.The file looks like a standard Python config file:[default]idp-url=https://sso.example.com/idp/profile/SAML2/Unsolicited/SSO?providerId=urn:amazon:webservicesusername=myuserA CLI-based version of this would be$ alohomora --username myuser --idp-url https://sso.example.com/idp/profile/SAML2/Unsolicited/SSO?providerId=urn:amazon:webservicesUsageYou can callalohomoradirectly from the command line.$ alohomora
Password:
Please select an authentication method
[ 0 ] Duo Push
[ 1 ] Phone Call
[ 2 ] Passcode
ID: 0
Pushed a login request to your device...

Please choose the role you would like to assume:
[ 0 ] arn:aws:iam::123456789012:role/a-fine-role
[ 1 ] arn:aws:iam::345678901234:role/a-particularly-fine-role
Selection:  1


----------------------------------------------------------------
Your new access key pair has been stored in the AWS configuration file /Users/myuser/.aws/credentials under the saml profile.
To use this credential, call the AWS CLI with the --profile option (e.g. aws --profile saml ec2 describe-instances).
----------------------------------------------------------------If you have multiple devices associated with your account, you will be asked to
select the device you want to use.Advanced ConfigurationMFA Configuration for DuoIf you have multiple Duo devices, you can addauth-deviceto your
configuration to select which device to use. If you aren't sure what
the names of your devices are, runalohomoraonce without an auth device
selected to have it display a prompt with a list of device names.
The auth device parameters is case-insensitive.In order to select a default Duo MFA method, you can addauth-methodto your
configuration.  A nonexhaustive list of supported values for Duo are:pushcallpasscode$ alohomora --auth-method call[default]idp-url=https://sso.example.com/idp/profile/SAML2/Unsolicited/SSO?providerId=urn:amazon:webservicesauth-method=pushAlohomora Config ProfilesYou can create multiple configuration profiles in the ~/.alohomora file, for example:[default]idp-url=https://sso.example.com/idp/profile/SAML2/Unsolicited/SSO?providerId=urn:amazon:webservicesauth-method=pushrole-name=a-fine-role[particularly-fine]idp-url=https://sso.example.com/idp/profile/SAML2/Unsolicited/SSO?providerId=urn:amazon:webservicesauth-method=pushrole-name=a-particularly-fine-roleIf you specify nothing else, alohomora will use thedefaultprofile.  To use
theparticularly-fineconfiguration, simply run$ alohomora --alohomora-profile particularly-fineAWS Config ProfilesBy default, alohomora saves the credentials under thesamlprofile.  If you
wish to save the generated IAM keys under a different AWS profile name, you can
specify theaws-profileoption.  Via the CLI this looks likealohomora --aws-profile myprofileOr in a config file:[default]...aws-profile=myprofileAccount NamesIf you have many AWS accounts, keeping track of account IDs can be hard.  We've
added the ability to drop a map of account IDs to friendly names in the config
file, that should help solve this problem.  To make use of this, add a new[account_map]section to the config like so:[default]...[account_map]123456789012=Dev Account210987654321=Prod AccountThis will modify the roles that get printed out, like so:Please choose the role you would like to assume:
[ 0 ] Dev Account: sso-admins - arn:aws:iam::123456789012:role/sso-admins
[ 1 ] Prod Account: sso-finance-readers - arn:aws:iam::210987654321:role/sso-finance-readersAlohomora doesn't support feeding these in via the command line, because that
would make your command WAY too long.Automatic Role SelectionIf you have many AWS accounts/roles and wish to have alohomora always use a
specific account and role, this can be done by specifying them in the
configuration section like so:[default]idp-url=https://sso.example.com/idp/profile/SAML2/Unsolicited/SSO?providerId=urn:amazon:webservicesauth-method=pushaccount=112233445566role-name=sso-adminsAWS Partition SelectionIf you run separate IdPs for your different commercial and GovCloud accounts,
alohomora should "just work": that is, the role lists will all update correctly,
the assertions will be formatted properly, etc.  We autodiscover the partition
you're working in based off the roles that are handed back to us.However, if you're using the same IdP to provide access to both commercial and
GovCloud,andyou're asking Alohomora to do automatic role selection, it's
hard for us to tell which partition you want to use.  You may need to manually
specify that by adding anaws-partitionoption as below.[default]...aws-partition=aws[awsgov]...aws-partition=aws-us-govOr, via the CLI:$ alohomora --aws-partition aws-us-govDebuggingLogs are written to~/.alohomora.logby default.Future FeaturesRespect the default factor option on the Duo account (push vs. text vs. call)Note for Windows UsersThis doesNOTwork in Cygwin or Cygwin based shells in Windows (such as Gitbash).  Use cmd instead.Contributors (Alphabetical)@abrooks@bcaselden-viasat@gcochard@gdw2@marksidell@Serilleous@skemper@wkronmiller@xrlThanksThis application was written with heavy assistance from anAWS Security Blog postthat Quint Van Deman of AWS wrote up.  Thanks Quint!