Package: aws-saml-auth
This command-line tool allows you to acquire AWS temporary (STS)
credentials using Google Workspace as a federated (Single Sign-On, or SSO) provider
or another SAML login provider.InstallationThe easiest option is to to install withpippipinstallaws-saml-authIts also possible to use the docker imageekreative/aws-saml-auth.SetupYou will need to know your SAML Providers SSO URL.For Google Workspace the url by right clicking copy url from the AWS
App that you setup in the Apps menu or from the ‘Test SAML Login’
button in the Apps settings.You can store the url in an env var or pass it to the–login-urlargument.exportASA_LOGIN_URL="https://accounts.google.com/o/saml2/initsso?idpid=XXX&spid=XXX&forceauthn=false"If you dont have an AWS SAML App available talk to your Administrator and point
them to theSetup AWS SAML and Google Workspacesection below.UsageYou can run the commandaws-saml-authto authenticate aws-cli. By default it will edit your default credentials.
You can export the variableAWS_PROFILE=my_profileand thenaws-saml-authand aws-cli will use this profile.$aws-saml-auth-husage:aws-saml-auth[-h][--redirect-server|-LLOGIN_URL][-RREGION][-dDURATION|--auto-duration][-pPROFILE][-AACCOUNT][-q][--saml-assertionSAML_ASSERTION][--no-saml-cache][--print-creds|--credential-process][--no-resolve-aliases][--portPORT][--no-ask-role|-rROLE_ARN][-l{debug,info,warn}][-V]AcquiretemporaryAWScredentialsviaSAMLoptionalarguments:-h,--helpshowthishelpmessageandexit--redirect-serverRuntheredirectserveronport($PORT)-LLOGIN_URL,--login-urlLOGIN_URLSAMLProviderloginurl($ASA_LOGIN_URL)-RREGION,--regionREGIONAWSregionendpoint($AWS_DEFAULT_REGION)-dDURATION,--durationDURATIONCredentialdurationinseconds(defaultstovalueof$ASA_DURATION,thenfallsbackto43200)--auto-durationTriestousethelongestallowedduration($ASA_AUTO_DURATION=1)-pPROFILE,--profilePROFILEAWSprofile(defaultstovalueof$AWS_PROFILE,thenfallsbackto'default')-AACCOUNT,--accountACCOUNTFilterforspecificAWSaccount($ASA_AWS_ACCOUNT)-q,--quietQuietoutput--saml-assertionSAML_ASSERTIONBase64encodedSAMLassertiontouse--no-saml-cacheDonotcachetheSAMLAssertion($ASA_NO_SAML_CACHE=1)--print-credsPrintCredentials--credential-processOutputsuitableforawsclicredential_process($ASA_CREDENTIAL_PROCESS=1)--no-resolve-aliasesDonotresolveAWSaccountaliases.($ASA_NO_RESOLVE_ALIASES=1)--portPORTPortfortheredirectserver($PORT)--no-ask-roleNeverasktopicktherole($ASA_NO_ASK_ROLE=1)-rROLE_ARN,--role-arnROLE_ARNTheARNoftheroletoassume($ASA_ROLE_ARN)-l{debug,info,warn},--log{debug,info,warn}Selectloglevel(default:warn)-V,--versionshowprogram'sversionnumberandexitCredential ProcessIn you aws config file (~/.aws/config) you can setup a profile to use the credential process[profile my_profile]credential_process=aws-saml-auth --credential-processregion=eu-west-1asa.login_url=https://accounts.google.com/o/saml2/initsso?idpid=some_idp&spid=some_spid&forceauthn=falseIf you have multiple roles available you must add theasa.role_arnsetting. You can also use this to have multiple
profiles with different AWS accounts.AWS process will trigger the login flow automatically whenever your credentials expire.Via DockerSet environment variables for anything listed in Usage with($VARIABLE)after command line option:ASA_LOGIN_URL(see above under “Important Data” for how to find these)AWS_PROFILE: Optional profile name you want the credentials set for (default is ‘sts’)ASA_ROLE_ARN: Optional ARN of the role to assumeFor Docker:docker run-it-eASA_LOGIN_URL-eAWS_PROFILE-eASA_ROLE_ARN-p4589:4589-v~/.aws:/root/.awsekreative/aws-saml-authYou will be be shown a URL to visit in your browserIf you have more than one role available to you (and you haven’t set up ASA_ROLE_ARN),
you’ll be prompted to choose the role from a list.Storage of profile credentialsThrough the use of AWS profiles, using the-por--profileflag, theaws-saml-authutility will store the supplied Login Url details in your./aws/configfiles.When re-authenticating using the same profile, the values will be remembered to speed up the re-authentication process.
This enables an approach that enables you to provide your Login URL value only onceSetup AWS SAML and Google WorkspaceYou’ll first have to set up your SAML identity provider
(IdP) for AWS. There are tasks to be performed on both the Google Workspace
and the Amazon sides; these references should help you with those
configurations:How to Set Up Federated Single Sign-On to AWS Using Google
AppsUsing Google Apps SAML SSO to do one-click login to
AWSIf you need a fairly simple way to assign users to roles in AWS
accounts, we have another tool calledGoogle AWS
Federatorthat might help you.NoteIf you want a longer session than the AWS default 3600 seconds (1 hour)
duration, you must also modify the IAM Role to permit this. Seethe AWS documentationfor more information.To enable browser based login, you will need to host the redirect server
somewhere with HTTPS enabled, you might use a serverless google cloud run deployment for example:gcloudrundeploy--imageekreative/aws-saml-auth--args=--redirect-server--platformmanagedThen change your SAML provider settings so theACS URLpoints to the redirect server.You will also need to change the Trust Relationship of your IAM Role to allowSAML:audto be the host of your redirect server.See the example, replacing“https://redirect-server.com/saml”with your own.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Federated":"arn:aws:iam::XXX:saml-provider/XXX"},"Action":"sts:AssumeRoleWithSAML","Condition":{"StringEquals":{"SAML:aud":["https://signin.aws.amazon.com/saml","https://redirect-server.com/saml"]}}}]}DevelopmentIf you want to develop the Aws-saml-auth tool itself, we thank you! In order
to help you get rolling, you’ll want to install locally with pip. Of course,
you can use your own regular workflow, with tools likevirtualenv.# Installpipinstall-e.We welcome you to review ourcode of conductandcontributingdocuments.AcknowledgmentsThis work is inspired byaws-google-auth– this version has changed to use browser login flow only and avoid handling user passwords.