Skip to main content
Join the official 2019 Python Developers SurveyStart the survey!

CLI login to AWS using OpenID Connect

Project description

Log in to AWS using OpenID Connect

The aim for this is to create a general purpose CLI OIDC login with a limited set of trusted dependencies.

Tested with Azure AD. Your mileage may vary with other providers, please let us know!

Codeship Status for NitorCreations/aws-oidc-login

Setup (Azure AD example)

  • Create Azure AD App
    • Set public client reply url to http://localhost
    • Add an appRole (may be unnecessary)
    • Add users(s) to the role (to the app)
  • Create an AWS OIDC identity provider
    • Authority URL will be https://login.microsoftonline.com/<AAD tenant id>/oauth2/v2.0
    • Add your AAD app client id as audience
  • Create a web identity role with permissions you'd like
    • Edit trust relationship for the role to allow role assumption with tokens issued by AAD for your app
  • Add parameters under a suitable profile ~/.aws/config:
    • Add your application id (client id) from AAD app
    • Add your AAD tenant id
    • oidc_authority_url=https://login.microsoftonline.com/<AAD tenant id>/oauth2/v2.0
    • oidc_client_id=<id of your AAD app>
    • oidc_role_arn=<ARN of the role you are assuming on AWS>

Install aws-oidc-login

Clone this repo and run pip install aws-oidc-login inside it.

Run

The executable is called aol. Log in with default profile by simply running aol or specify a profile with aol [profile].

See aol -h for more options.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for aws-oidc-login, version 0.2.0
Filename, size File type Python version Upload date Hashes
Filename, size aws_oidc_login-0.2.0-py2.py3-none-any.whl (11.6 kB) File type Wheel Python version py2.py3 Upload date Hashes View hashes
Filename, size aws-oidc-login-0.2.0.tar.gz (7.4 kB) File type Source Python version None Upload date Hashes View hashes

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page