gw2aws
SAML login to AWS via Google Workspace using Playwright.
Based on the behavior of the saml2aws Browser provider, gw2aws enables automated authentication for Google Workspace SSO.
Install
# mise via github
mise use -g github:eggplants/gw2aws
# mise via pipx
mise use -g pipx:gw2aws
# pipx
pipx install gw2aws
# pip
pip install gw2aws
Docker
Multi-arch images are published to GHCR on each release:
docker pull ghcr.io/eggplants/gw2aws
The container needs the profile config and ~/.aws mounted, and -it so the
password/TOTP prompts work:
docker run --rm -it \
-v "$HOME/.config/gw2aws:/root/.config/gw2aws" \
-v "$HOME/.aws:/root/.aws" \
ghcr.io/eggplants/gw2aws login --profile myprofile
--no-headless is not usable in the container (no display); the default
headless login is what runs there.
Requirements
You must have a Google Workspace account with 2FA enabled and TOTP registered as an authentication method.
Usage
gw2aws configure --profile myprofile
gw2aws login --profile myprofile
gw2aws login --profile myprofile --no-headless
gw2aws login --profile myprofile --force
aws --profile myprofile sts get-caller-identity
Configuration
gw2aws configure writes a per-profile JSON file. Each profile holds:
| Field | Description | op:// ok? |
|---|---|---|
url |
Google IdP-initiated SSO (SAML) login URL | |
email |
Google Workspace account email | ✅ |
password |
Google password (optional; prompted at login if empty) | ✅ |
totp_url |
otpauth:// URL for TOTP (optional; prompted at login if empty) |
✅ |
region |
AWS region for the STS call (default us-east-1) |
|
role_arn |
Role to auto-select (optional; prompted if empty and multiple roles) | |
session_duration |
STS credential lifetime in seconds (default 3600) |
|
save_session_cookie |
Persist the Google session cookie to skip login on reuse (--force bypasses it) |
Storage locations
- Profile config:
~/.config/gw2aws/<profile>.json(mode0600; honorsGW2AWS_CONFIG_DIR/XDG_CONFIG_HOME) - Session cookie:
~/.config/gw2aws/<profile>.storage_state.json - AWS credentials:
~/.aws/credentials(written under the profile name on login)
1Password references
email, password, and totp_url can be set to a 1Password secret reference
(op://vault/item/field) instead of the raw value. At login time they are
resolved via op read, so nothing secret is stored in the profile JSON. This
requires the 1Password CLI to be
installed and signed in.
References
1 maintainer
Metadata
1 maintainer
Release files for gw2aws 0.1.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| gw2aws-0.1.4.tar.gz | 18.5 kB | Without provenance | Details for gw2aws-0.1.4.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| gw2aws-0.1.4-py3-none-any.whl | Python 3 | none | any | Details for gw2aws-0.1.4-py3-none-any.whl |
Total release size: 39.0 kB
Release files / gw2aws-0.1.4.tar.gz
| Download URL | gw2aws-0.1.4.tar.gz |
|---|---|
| Size | 18.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8a5b793b83cdb0b794f3b8de63f1d43e60984069c00801547534334492aa9ed0
|
|
BLAKE2b-256 checksum How to use checksums |
14fc2df36329f2de32a1ae2e1a577fefe81ec27b5701ca4ac5c1c6416ce9c400
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / gw2aws-0.1.4-py3-none-any.whl
| Download URL | gw2aws-0.1.4-py3-none-any.whl |
|---|---|
| Size | 20.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
cd06a5cdb953a842672e2251b2acce17c53499ab20c591fb2ec5818cf0bb4135
|
|
BLAKE2b-256 checksum How to use checksums |
b2e31609d4a2254c2aa9f8fa12b74f3a0bc64108928171a09398853af8635787
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Security for gw2aws 0.1.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
