Package: yawsso
yawssoYet Another AWS SSO - sync up AWS CLI v2 SSO login session to legacy CLI v1 credentials.See alsoRelease v1.0.0 NotesPrerequisiteRequiredPython >= 3.7RequiredAWS CLI v2Assume you have already setupAWS SSOfor your organizationMain Use CaseInstalllatest from PyPIlike so:pip install yawssoDo your per normal SSO login and, have at least one active SSO session cache:aws sso login --profile devTo sync for all named profiles in config (i.e.lazy consensus), then just:yawssoTo sync default profile and all named profiles, do:yawsso --defaultTo sync default profile only, do:yawsso --default-onlyTo sync for selected named profile, do:yawsso -p devTo sync for multiple selected named profiles, do:yawsso -p dev prodTo sync for default profile as well as multiple selected named profiles, do:yawsso --default -p dev prodTo sync for all named profiles start with prefix patternlab*, do:(zsh)
yawsso -p 'lab*'

(bash)
yawsso -p lab*To sync for all named profiles start withlab*as well asdevandprod, do:yawsso -p 'lab*' dev prodPrint help to see other options:yawsso -hThen, continue per normal with your daily tools. i.e.cdk deploy ...terraform apply ...cw ls groupsawsbw -L -P devsqsmover -s main-dlq -d main-queueecs-cli ps --cluster my-clusterawscurl -H "Accept: application/json" --profile dev --region ap-southeast-2 "https://api..."Additional Use CasesRename Profile on SyncSay, you have the following profile in your$HOME/.aws/config:[profile dev]
sso_start_url = https://myorg.awsapps.com/start
sso_region = ap-southeast-2
sso_account_id = 123456789012
sso_role_name = AdministratorAccess
region = ap-southeast-2
output = json
cli_pager =You want to populate access token as, say, profile namefooin$HOME/.aws/credentials:[foo]
region = ap-southeast-2
aws_access_key_id = XXX
aws_secret_access_key = XXX
aws_session_token = XXX
...Do like so:yawsso -p dev:fooThen, you canexport AWS_PROFILE=fooand usefooprofile!Export TokensPLEASE USE THIS FEATURE WITH CARE SINCEENVIRONMENT VARIABLES USED ON SHARED SYSTEMS CAN GIVE UNAUTHORIZED ACCESS TO PRIVATE RESOURCES.🤚 START FROM VERSION1.0.0,yawsso -eEXPORT TOKENS INROT13ENCODED STRING.Use-eflag if you want a temporary copy-paste-able time-gated access token for an instance or external machine.Please note that, it usesdefaultprofile if no additional arguments pass.yawsso -e | yawsso decrypt
export AWS_ACCESS_KEY_ID=xxx
export AWS_SECRET_ACCESS_KEY=xxx
export AWS_SESSION_TOKEN=xxxThis use case is especially tailored for those who usedefaultprofile and, who would like to PIPE commands as follows.aws sso login && yawsso -e | yawsso decrypt | pbcopyOtherwise, for a named profile, do:yawsso -p dev -e | yawsso decryptOr, right away export credentials into the current shell environment variables, do:yawsso -p dev -e | yawsso decrypt | source /dev/stdinNote: ☝️ are mutually exclusive with the following 👇 auto copy into your clipboard.Choose one, a must!If you havepyperclippackage installed,yawssowill copy access tokens to your clipboard instead.yawsso -e
Credentials copied to your clipboard for profile 'default'You maypip install pyperclipor, together withyawssoas follows.pip install 'yawsso[all]'LoginYou can also useyawssosubcommandloginto SSO login then sync all in one go.🙋‍♂️ NOTE: It usesdefaultprofile orAWS_PROFILEenvironment variable if optional argument--profileis absentyawsso login -h
yawsso loginOtherwise you can pass thelogin profileas follows:yawsso login --profile devDue tolazy consensusdesign,yawssowill sync all named profiles once SSO login has succeeded. If you'd like to sync only upto thislogin profilethen use--thisflag to limit as follows.👉 Login using default profile and sync only uptothisdefault profileyawsso login --this👉 Login using named profile dev and sync only uptothisdev profileyawsso login --profile dev --this👉 Login using named profile dev and sync as foo. See above for more details on renaming, limited to one profile.yawsso login --profile dev:fooLogin then Export tokenExporting access token also support with login subcommand as follows:👉 Login using default profile, sync only uptothisdefault profile and, print access tokenyawsso login -e | yawsso decrypt👉 Login using named profile dev, sync only uptothisdev profile and, print access tokenyawsso login --profile dev -e | yawsso decryptAuto Login then SyncLikelogin, you may useyawssosubcommandautoto SSO login then sync all in one go.It will check if SSO session has expired and, if so,yawssowill attempt to auto login again.yawsso auto -h

(either)
yawsso auto --profile dev

(or)
export AWS_PROFILE=dev
yawsso autoEncryptionyawssocan encrypt and decrypt some arbitrary string fromstdinusingROT13(a simple letter substitution cipher) as follows.echo 'Hello this is a test' | yawsso encrypt
Uryyb guvf vf n grfg

echo 'Uryyb guvf vf n grfg' | yawsso decrypt
Hello this is a test

(or Pipe through some text corpus)
cat test.txt | yawsso encrypt

(or on Windows)
type test.txt | yawsso encryptThis is the same as using trivial Unixtrcommand as follows.echo 'Hello this is a test' | tr 'A-Za-z' 'N-ZA-Mn-za-m'
Uryyb guvf vf n grfg

echo 'Uryyb guvf vf n grfg' | tr 'A-Za-z' 'N-ZA-Mn-za-m'
Hello this is a testHence, you could also decodeyawssoexported tokens usingtrcommand, like so.yawsso -p dev -e | tr 'A-Za-z' 'N-ZA-Mn-za-m'DevelopCreate virtual environment, activate it and then:make install
make test
python -m yawsso --trace version(Windows)python -m venv venv
.\venv\Scripts\activate
pip install ".[dev,test]" .
pytest
python -m yawsso --trace versionCreate issue or pull request welcomeLicenseMIT License