Package: aws-sso-credential-process
aws-sso-credential-processGet AWS SSO working with all the SDKs that don't understand it yetCurrently,AWS SSOsupport is implemented in theAWS CLI v2, but the capability to usage the credentials retrieved from AWS SSO by the CLI v2 has not been implemented in the various AWS SDKs. However, they all support thecredential processsystem. This tool bridges the gap by implementing a credential process provider that understands the SSO credential retrieval and caching system. Once AWS implements the necessary support in the SDK for your favorite language, this tool will no longer be necessary.If you try this and your tools still don't work with the credentials, you can get the credentials themselves usingaws-export-credentials, which can also inject them as environment variables for your program.QuickstartI recommend you installpipx, which installs the tool in an isolated virtualenv while linking the script you need.Mac:brewinstallpipx
pipxensurepathOther:python3-mpipinstall--userpipx
python3-mpipxensurepathInstall the tool.pipxinstallaws-sso-credential-processSet up your.aws/configfile for AWS SSO as normal (see step 6 for how to make this easier):[profile my-sso-profile]

region = us-east-2
output = yaml

sso_start_url = https://something.awsapps.com/start
sso_region = us-east-2
sso_account_id = 123456789012
sso_role_name = MyLeastPrivilegeRoleThen, just add acredential_processentryto the profile, using the--profileflag with the same profile name (see step 6 for how to make this easier):[profile my-sso-profile]

credential_process = aws-sso-credential-process --profile my-sso-profile

region = us-east-2
output = yaml

sso_start_url = https://something.awsapps.com/start
sso_region = us-east-2
sso_account_id = 123456789012
sso_role_name = MyLeastPrivilegeRoleYou're done! Test it out:awsssologin--profilemy-sso-profile
python-c"import boto3; print(boto3.Session(profile_name='my-sso-profile').client('sts').get_caller_identity())"NOTE: if you test it out with your favorite script or application and get something likeNoCredentialProviders: no valid providers in chain., you may need to set the environment variableAWS_SDK_LOAD_CONFIG=1. The Go SDK, and applications built with the Go SDK (like Terraform)don't automatically use your.aws/configfile.Streamline the process. If you've got one main AWS SSO configuration, set up your.bashrc(or similar) like this:export AWS_CONFIGURE_SSO_DEFAULT_SSO_START_URL=https://something.awsapps.com/start
export AWS_CONFIGURE_SSO_DEFAULT_SSO_REGION=us-east-2Useaws-configure-sso-profileto set up your AWS SSO profiles. This will set up your profile as shown above interactively, including prompting you to select from available accounts and roles. It will look something like this:$ aws-configure-sso-profile --profile my-sso-profile
SSO start URL [https://something.awsapps.com/start]:
SSO Region [us-east-2]:
Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso.us-east-2.amazonaws.com/

Then enter the code:

ABCD-WXYZ
There are N AWS accounts available to you.
Using the account ID 123456789012
The only role available to you is: MyLeastPrivilegeRole
Using the role name "MyLeastPrivilegeRole"
CLI default client Region [None]: us-east-2
CLI default output format [None]: yaml

To use this profile, specify the profile name using --profile, as shown:

aws s3 ls --profile my-sso-profileConfigurationTheaws-configure-sso-profiletool wrapsaws configure ssoto help you set up profiles in.aws/config; you can set the environment variablesAWS_CONFIGURE_SSO_DEFAULT_SSO_START_URLandAWS_CONFIGURE_SSO_DEFAULT_SSO_REGIONto set defaults for those values so you're not typing them all the time. The tool will set up thecredential_processentry as well. Note that--profileis required (unlikeaws configure sso).The order of configuration matches the AWS CLI and SDKs: values from CLI parameters take precedence, followed by env vars, followed by settings in.aws/config.The--profileparameter onaws-sso-credential-processdoesn't work like the same parameter on the AWS CLI, and cannot be set from the environment; it's intended only to help make thecredential_processentry in a profile more concise.Interactive authenticationThe most important thing to determine is whether or not you want to allow interactive authentication, which is off by default (so that the behavior is the same as the AWS CLI v2).When interactive authentication is off, you need to use the CLI v2'saws sso loginto login through AWS SSO. If you haven't logged in or your session has expired, the process will fail and interrupt whatever you're doing.With interactive authentication turned on, the functionality ofaws sso loginwill be triggered automatically; a browser will pop up to prompt you to log in (or, if you're already logged in, it will prompt you to approve the login). This is useful when you're running scripts interactively, but bad for automated processes that are incapable of logging in.To enable interactive authentication, the best way is to setAWS_SSO_INTERACTIVE_AUTH=truein your environment.This lets you control whether interactive auth is enabled for a given profile depending on the situation you're using it for. Otherwise, you can setsso_interactive_auth=truein your profile in.aws/config, or use the--interactiveflag for the process. Note that you can use the--noninteractiveflag to disable interactive auth even if the environment variable is set.When setting up a profile usingaws-configure-sso-profile, you can use--set-auth-interactiveor--set-auth-noninteractiveto fix that profile as either interactive or noninteractive, respectively.Note that if you've got your profile set up as shown above, the AWS CLI v2 won't get interactive authentication, because it will natively use the profile configuration, skipping this tool as a credential process. If youreallywant interactive auth with the CLI, you could put the AWS SSO configuration information as parameters to the tool in the credential process directive, instead of directly in the profile, and then the CLI will use credential process as well, but I don't really recommend this route.DebuggingSetting the--debugflag or the env varAWS_SSO_CREDENTIAL_PROCESS_DEBUG=truewill cause debug output to be sent to.aws/sso/aws-sso-credential-process-log.txt. Note that this file will contain your credentials, though these credentials are both short-lived and also cached within the same directory.Account.aws/config:sso_account_idenv var:AWS_SSO_ACCOUNT_IDparameter:--account-idRole.aws/config:sso_role_nameenv var:AWS_SSO_ROLE_NAMEparameter:--role-nameSSO Start URL.aws/config:sso_start_urlenv var:AWS_SSO_START_URLparameter:--start-urlSSO Region.aws/config:sso_regionenv var:AWS_SSO_REGIONparameter:--region