CLI login to AWS using OpenID Connect
Project description
Log in to AWS using OpenID Connect
The aim for this is to create a general purpose CLI OIDC login with a limited set of trusted dependencies.
Tested with Azure AD. Your mileage may vary with other providers, please let us know!
Setup (Azure AD example)
- Create Azure AD App
- Set public client reply url to
http://localhost
- Add an appRole (may be unnecessary)
- Add users(s) to the role (to the app)
- Set public client reply url to
- Create an AWS OIDC identity provider
- Authority URL will be
https://login.microsoftonline.com/<AAD tenant id>/oauth2/v2.0
- Add your AAD app client id as audience
- Authority URL will be
- Create a web identity role with permissions you'd like
- Edit trust relationship for the role to allow role assumption with tokens issued by AAD for your app
- Add parameters under a suitable profile ~/.aws/config:
- Add your application id (client id) from AAD app
- Add your AAD tenant id
oidc_authority_url=https://login.microsoftonline.com/<AAD tenant id>/oauth2/v2.0
oidc_client_id=<id of your AAD app>
oidc_role_arn=<ARN of the role you are assuming on AWS>
Install aws-oidc-login
Clone this repo and run "pip install aws-oidc-login
" inside it.
Run
The executable is called aol
. Log in with default profile by simply running aol
or specify a profile with aol [profile]
.
See aol -h
for more options.
Project details
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
aws-oidc-login-0.1.0.tar.gz
(7.1 kB
view hashes)
Built Distribution
Close
Hashes for aws_oidc_login-0.1.0-py2.py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 3b3c7709fc6bb4afacd4035bcbbd801a66af6d41dfe35d572f2990e9e969103d |
|
MD5 | 5a703d9f5eb7230add676f72c454191a |
|
BLAKE2b-256 | dd0dfde91319d824cd1ddb72ff291e2e25915ca7b2b79df2533f44704cdd8077 |