How to log in to multiple AWS accounts — the easy way
Tags: aws, devops, security, cloud
Published: 2022-09-15 03:49:52

Here’s how it goes: you’ve got a Chrome window open for your Production AWS account, and a Firefox window open for the Staging account. There’s a Safari window open for the Dev account, and an incognito Firefox window open for the Sandbox account. Buried somewhere in your dock’s 200 open windows is a Chrome incognito account for the *other* Sandbox account (because your org really, really cares about account-level separation), but by the time you manage to find it your session will probably be expired and you’ll have to go through the whole kerfuffle of signing in again.

I can’t explain to you *why* AWS decided to make their user experience like this — who am I to question the will of God? But I *can* offer you a solution: a simple, open-source CLI tool that’ll take you 10 minutes to install and will save you from AWS browser window hell forever.

Here’s how [Granted](https://github.com/common-fate/granted) CLI works. Run the `assume` command in your terminal and pick which AWS profile to sign in to (in my case, `testing`):

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l7je8n88jt52w9g3l9jh.png)

And in a few seconds, it’ll open a new tab in your browser of choice (in my case, Firefox):


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/omrkebi9fz39tldwjbha.png)

Now let’s say you want to work in a second AWS account simultaneously. All you have to do is run the same command, this time selecting a different profile (in my case, `release`)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o57h5rtmfesdta8x6502.png)

And then you’ll have a second tab open in a new container:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3o0q5k3pybgchgjb2e2z.png)

You can switch between these tabs to work in these accounts simultaneously with no extra hassle. Opening another profile is as simple as just running another command.

If you think this is as cool as we do, you can read our [Getting Started guide](https://docs.commonfate.io/granted/getting-started/) to get set up with Granted — but to save you a click I’ll run through the MacOS instructions here (the Getting Started guide contains specific instructions for Linux and Windows, too).

First, you’ll need to set up at least once role in your [AWS config file](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html). On MacOS, this is stored in `~/.aws/config`. A config file for AWS SSO should look something like this:

```
# ~/.aws/config
# Change the values below to match your AWS SSO configuration
# Granted uses the profile name: in this case 'my-profile' to choose the role.

[profile my-profile]
sso_start_url=https://mycompany.awsapps.com/start
sso_region=us-east-1
sso_account_id=123456789012
sso_role_name=DeveloperRole
region=us-east-1
```

(you can use AWS IAM too - but we recommend SSO.)

Once you’ve got that set up, you can use Homebrew to install Granted:

```
brew tap common-fate/granted
brew install granted
```

And verify your installation:

```
➜ granted -v

Granted v0.2.9
```

(mine is v0.2.9 at the time of writing — yours will probably be a later version)

Once you’ve verified that Granted is installed correctly, you can run the `assume` command to get started with the setup wizard where you’ll be prompted to choose your browser.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xa2wb4rued8g4hbjmrc1.png)

After setup, you can run `assume` again to choose roles:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c35nqud5ysppedohx4rn.png)

You can also pass the role name directly and use the -c flag to open the console, e.g. `assume -c testing`.

And that’s it! If you’ve got any questions, you can check out [the docs](https://docs.commonfate.io/granted/getting-started) or join our [Slack](https://join.slack.com/t/commonfatecommunity/shared_invite/zt-q4m96ypu-_gYlRWD3k5rIsaSsqP7QMg) where we’ll be happy to chat with you directly. And if you like Granted, you can follow our [Twitter](https://twitter.com/CommonFateTech) for updates and terrible jokes.

Happy ClickOpsing!