About Go Aws Sso

Makes dealing with AWS SSO Logins an ease

Alternatives to Go Aws Sso

View All

Awsesh

An AWS session and credential manager and SDK ✨

133

Awsui

A modern Textual-powered AWS UI for lightning-fast profile switching, seamless SSO re-auth, Amazon Q integration, smart CLI autocomplete, and bilingual UI.

117

Published by

theurichde

Visit View Profile

Go Aws Sso

View on GitHub

go-aws-sso

Make working with AWS SSO on local machines an ease.

What is it about?

Choose and retrieve short-living role credentials from all of your SSO available accounts and roles
No nasty manual copy and pasting of credentials

But... why? 🤔

You have one go-to binary
No external dependencies (e.g. a python runtime)
Forget about dealing with different profiles and role names, just choose them directly!

Features

Choose your desired account and role interactively
Choose your account and role via flags from command line
Utilize AWSs credential_process to avoid storing credentials locally
- Locks concurrent calls to credential_process to no DDoS your Browser (this behaviour occurs from time to time when using e.g. the k8s plugin for IntelliJ)
Refresh credentials based on your previously chosen account and role (if you've chosen to persist your credentials)
Store your Start-URL and region
Set different profiles for your different accounts

Getting Started

Installation

via homebrew
- brew tap theurichde/go-aws-sso && brew install go-aws-sso
Download your according target platform binary from the releases page
Compile from source with go build -v ./cmd/go-aws-sso
use go install github.com/theurichde/go-aws-sso/cmd/go-aws-sso@main
- Maybe you want to make sure your GOBIN is in your PATH 😉

Usage

Interactively Assume a Role

Just execute go-aws-sso
- When you run go-aws-sso the first time, you will be prompted for your SSO Start URL and your region
- A config file (located at $HOME/$CONFIG_DIR/go-aws-sso/config.yml) will be written with your values
❔ Verify your client request if necessary
✅ Choose the account you want the roles to be displayed
✅ Choose a role
- in case there is only one role available this role is taken as default
🥳 Tadaa 🥳
- credentials_process is written to ~/.aws/credentials and fetches fresh credentials every time something calls AWS (implementing a proper credentials caching mechanism is up to the calling program)
- if you've added the flag --persist: short living credentials are written to ~/.aws/credentials

Directly Assume a Role From Command Line

$ ./go-aws-sso help assume
NAME:
   go-aws-sso assume - Assume directly into an account and SSO role

USAGE:
   go-aws-sso assume [command options] [arguments...]

DESCRIPTION:
   Assume directly into an account and SSO role

OPTIONS:
   --start-url value, -u value     set / override the SSO login start-url. (Example: https://my-login.awsapps.com/start#/)
   --region value, -r value        set / override the AWS region
   --profile value, -p value       the profile name you want to set in your ~/.aws/credentials file (default: "default")
   --persist                       whether or not you want to write your short-living credentials to ~/.aws/credentials (default: false)
   --force                         removes the temporary access token and forces the retrieval of a new token (default: false)
   --debug                         enables debug logging (default: false)
   --headless                      show the verification URL without opening it in a browser (default: false)
   --role-name value, -n value     The role name you want to assume
   --account-id value, -a value    The account id where your role lives in
   --quiet, -q                     disables logger output (default: false)
   --help, -h                      show help

Execute go-aws-sso assume --account-id YOUR_ID --role-name YOUR_ROLE_NAME
Optionally: Set / override your start url and region via flag

Refresh Credentials

Refreshing credentials is only useful, if you persist your credentials (SecretAccessKey etc.) in your ~/.aws/credentials file

$ go-aws-sso help refresh
NAME:
   go-aws-sso refresh - Refresh your previously used credentials.

USAGE:
   go-aws-sso refresh [command options] [arguments...]

DESCRIPTION:
   Refreshes the short living credentials based on your last account and role.

OPTIONS:
   --start-url value, -u value  set / override the SSO login start-url. (Example: https://my-login.awsapps.com/start#/)
   --region value, -r value     set / override the AWS region
   --profile value, -p value    the profile name you want to set in your ~/.aws/credentials file (default: "default")
   --persist                    whether or not you want to write your short-living credentials to ~/.aws/credentials (default: false)
   --force                      removes the temporary access token and forces the retrieval of a new token (default: false)
   --debug                      enables debug logging (default: false)
   --headless                   show the verification URL without opening it in a browser (default: false)
   --help, -h                   show help

Configuration

If you want to point to a specific non-default Browser, do so via the BROWSER environment variable

Headless Mode

If you prefer not to have the browser opened automatically during SSO authorization, you can enable headless mode:

via the --headless CLI flag
via the GO_AWS_SSO_HEADLESS environment variable (any non-empty value)

When enabled, the verification URL is printed to the terminal and must be opened manually.

# Flag
$ go-aws-sso --headless

# Environment variable
$ GO_AWS_SSO_HEADLESS=1 go-aws-sso

Basics

$ go-aws-sso config                                 
NAME:
   go-aws-sso config - Handles configuration. Note: Config location defaults to $HOME/$CONFIG_DIR/go-aws-sso/config.yml

USAGE:
   go-aws-sso config command [command options] [arguments...]

COMMANDS:
   generate  Generate a config file
   edit      Edit the config file
   help, h   Shows a list of commands or help for one command

OPTIONS:
   --help, -h  show help (default: false)

Config Generation

$ go-aws-sso config generate --help
NAME:
   go-aws-sso config generate - Generate a config file

USAGE:
   go-aws-sso config generate [command options] [arguments...]

DESCRIPTION:
   Generates a config file. All available properties are interactively prompted if not set with command options.
   Overrides the existing config file!

OPTIONS:
   --start-url value, -u value   set / override the SSO login start-url. (Example: https://my-login.awsapps.com/start#/)
   --region value, -r value      set / override the AWS region
   --help, -h                    show help

Config Editing

$ go-aws-sso config edit --help    
NAME:
   go-aws-sso config edit - Edit the config file

USAGE:
   go-aws-sso config edit [command options] [arguments...]

DESCRIPTION:
   Edit the config file. All available properties are interactively prompted.
   Overrides the existing config file!

OPTIONS:
   --help, -h  show help (default: false)

Example Usage

$ go-aws-sso help  
NAME:
   go-aws-sso - Retrieve short-living credentials via AWS SSO & SSOOIDC

USAGE:
   go-aws-sso [global options] command [command options] [arguments...]

VERSION:
   v1.2.0

COMMANDS:
   config   Handles configuration. Note: Config location defaults to $HOME/$CONFIG_DIR/go-aws-sso/config.yml
   refresh  Refresh your previously used credentials.
   assume   Assume directly into an account and SSO role
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --start-url value, -u value  set / override the SSO login start-url. (Example: https://my-login.awsapps.com/start#/)
   --region value, -r value     set / override the AWS region
   --profile value, -p value    the profile name you want to set in your ~/.aws/credentials file (default: "default")
   --persist                    whether or not you want to write your short-living credentials to ~/.aws/credentials (default: false)
   --force                      removes the temporary access token and forces the retrieval of a new token (default: false)
   --debug                      enables debug logging (default: false)
   --headless                   show the verification URL without opening it in a browser (default: false)
   --help, -h                   show help
   --version, -v                print the version

./go-aws-sso

2021/11/08 19:34:40 WARN No Start URL given. Please set it now.
✔ SSO Start URL: https://my-sso-login.awsapps.com
Search: █
? Select your AWS Region. Hint: FuzzySearch supported: 
  ▸ us-east-2
    us-east-1
    us-west-1
    us-west-2
    af-south-1
    ap-east-1
    ap-south-1
    ap-northeast-3
    ap-northeast-2
    [...]
2021/11/08 19:34:40 INFO Config file generated: /home/theurichde/.config/go-aws-sso/config.yml
2021/11/08 19:34:40 WARN Please verify your client request: https://device.sso.eu-central-1.amazonaws.com/?user_code=USR-CDE
2021/11/08 19:34:40 INFO Still waiting for authorization...
Search: 
? Select your account - Hint: fuzzy search supported. To choose one account directly just enter #{Int}: 
  ▸ #0 Awesome API - SDLC YYYYYXXXXXXX
    #1 Team Sandbox XXXXXXXXXXXX
    #2 Awesome API - Production YYYYYYYYYYYY

2021/11/08 19:34:43 INFO Selected account: Team Sandbox - XXXXXXXXXXXX

2021/11/08 19:34:43 INFO Only one role available. Selected role: AWSAdministratorAccess
2021/11/08 19:34:43 INFO Credentials expire at: 2021-11-08 20:34:43 +0100 CET

Contributions

Contributions are highly welcome!

Feel free to contribute enhancements or bug fixes.
- Fork this repo, apply your changes and create a PR pointing to this repo and the main branch
If you have any ideas or suggestions please open an issue and describe your idea or feature request

License

This project is licensed under the MIT License - see the LICENSE.md file for details

Go Aws Sso

About Go Aws Sso

Platforms

Languages

Links

Need Help Installing Go Aws Sso?

Alternatives to Go Aws Sso

Awsesh

Awsui

Go Aws Sso

go-aws-sso

What is it about?

But... why? 🤔

Features

Getting Started

Installation

Usage

Interactively Assume a Role

Directly Assume a Role From Command Line

Refresh Credentials

Configuration

Headless Mode

Example Usage

Contributions

License