gw2aws

SAML login to AWS via Google Workspace using Playwright.

Based on the behavior of the saml2aws Browser provider, gw2aws enables automated authentication for Google Workspace SSO.

Install

# mise via github
mise use -g github:eggplants/gw2aws

# mise via pipx
mise use -g pipx:gw2aws

# pipx
pipx install gw2aws

# pip
pip install gw2aws

Docker

Multi-arch images are published to GHCR on each release:

docker pull ghcr.io/eggplants/gw2aws

The container needs the profile config and ~/.aws mounted, and -it so the password/TOTP prompts work:

docker run --rm -it \
  -v "$HOME/.config/gw2aws:/root/.config/gw2aws" \
  -v "$HOME/.aws:/root/.aws" \
  ghcr.io/eggplants/gw2aws login --profile myprofile

--no-headless is not usable in the container (no display); the default headless login is what runs there.

Requirements

You must have a Google Workspace account with 2FA enabled and TOTP registered as an authentication method.

Usage

gw2aws configure --profile myprofile

gw2aws login --profile myprofile
gw2aws login --profile myprofile --no-headless
gw2aws login --profile myprofile --force

aws --profile myprofile sts get-caller-identity

Configuration

gw2aws configure writes a per-profile JSON file. Each profile holds:

Storage locations

• Profile config: ~/.config/gw2aws/<profile>.json (mode 0600; honors GW2AWS_CONFIG_DIR / XDG_CONFIG_HOME)
• Session cookie: ~/.config/gw2aws/<profile>.storage_state.json
• AWS credentials: ~/.aws/credentials (written under the profile name on login)

1Password references

email, password, and totp_url can be set to a 1Password secret reference (op://vault/item/field) instead of the raw value. At login time they are resolved via op read, so nothing secret is stored in the profile JSON. This requires the 1Password CLI to be installed and signed in.

References

• https://github.com/Versent/saml2aws
• https://aws.amazon.com/jp/blogs/security/how-to-implement-a-general-solution-for-federated-apicli-access-using-saml-2-0/