Hi, I am Agata.<\/p>\n\n\n\n
In this article, we will discuss how to use the CLI with AWS Single Sign-On (AWS SSO).<\/p>\n\n\n\n
There are two ways to obtain credentials from the SSO user portal or directly from the AWS CLI.
Both of these methods use the CLI with SSO, but I thought they were written in separate places in the AWS documentation and were inaccessible, so I summarized them here.<\/p>\n\n\n\n
This one is very simple. Simply configure the settings using the values displayed.
However, an expiration date exists for SSO authentication. (Default is 1 hour and can be extended up to 12 hours by configuration.)
Since authentication is required again after the expiration date, it is recommended to use the system when the use is not frequent and the duration of use is short.<\/p>\n\n\n\n
It is easiest because you can just run it straight through the CLI. The list of credentials (in macOS and Linux, export \u2026 ), simply paste it into the CLI and execute it.<\/p>\n\n\n\n
Setup to write authentication information in ~\/.aws\/credentials. Paste the credentials into the copied credeitials file.<\/p>\n\n\n\n
Set each value to the AWS service client.<\/p>\n\n\n\n
This one can be accessed directly from the CLI.
This one has the following advantages over the method accessed from the User Portal, so if you use the CLI frequently, this one is probably better suited for you.
There are automatic and manual configuration methods, but only the automatic configuration method is introduced here.<\/p>\n\n\n\n
Execute the following command and enter the SSO start URL and SSO region.
The SSO start URL is the URL of the SSO user portal (such as https:\/\/my-sso-portal.awsapps.com\/start ).
SSO region is the region where SSO is configured. Note that this is not the region you want to access. If you make a mistake in specifying this, you will get an “Invalid grant provided” error in the step in your browser.<\/p>\n\n\n\n
$ aws configure sso\nSSO start URL [None]: [None]: https:\/\/my-sso-portal.awsapps.com\/start\nSSO region [None]:us-east-1<\/code><\/pre>\n\n\n\nWhen entered, the following message will appear and the browser will open automatically.
If the browser does not open automatically, open https:\/\/device.sso.us-east-1.amazonaws.com\/ in your browser and enter the code shown in the message.<\/p>\n\n\n\n
Attempting to automatically open the SSO authorization page in your default browser.\nIf the browser does not open or you wish to use a different device to authorize this request, open the following URL:\n\nhttps://device.sso.us-east-1.amazonaws.com\/\n\nThen enter the code:\n\nXXXX-XXXX<\/code><\/pre>\n\n\n\nThe authentication process proceeds in the browser, and an “Allow” button is displayed on the “Authorize request” screen.
If you click “Allow” and there are no problems, “Request approved” will be displayed. If the SSO region is specified incorrectly, an error message “Invalid grant provided” will appear.<\/p>\n\n\n\n
Once the browser has successfully completed the process, return to the CLI.
The CLI will display a list of accessible AWS accounts, which you can select with the arrow keys and press Enter to confirm. If there is only one account in the list, it will be automatically selected and you can proceed.<\/p>\n\n\n\n
There are 2 AWS accounts available to you.\n> DeveloperAccount, developer-account-admin@example.com (123456789011) \n ProductionAccount, production-account-admin@example.com (123456789022)<\/code><\/pre>\n\n\n\nNext, select the IAM role to be used. If there is only one in the list, it will be selected automatically and you can proceed.<\/p>\n\n\n\n
Using the account ID 123456789011\nThere are 2 roles available to you.\n> ReadOnly\n FullAccess<\/code><\/pre>\n\n\n\nNext, set the default client region, default output format, and profile name.
These are the same settings that are normally made when using the CLI.
Note that if the environment variable AWS_PROFILE has been set, the environment variable value is automatically used without asking for the profile name.<\/p>\n\n\n\n
CLI default client Region [None]: us-west-2\nCLI default output format [None]: json\nCLI profile name [123456789011_ReadOnly]: my-dev-profile<\/code><\/pre>\n\n\n\nFinally, the following message is displayed and the configuration is complete.
Let’s execute the command with –profile as shown in the message.<\/p>\n\n\n\n
To use this profile, specify the profile name using --profile, as shown:\n\naws s3 ls --profile my-dev-profile<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Hi, I am Agata. In this article, we will discuss how to use the CLI with AWS Single Sign-On (AWS SSO). There are two ways to obtain credentials from the SSO user portal or directly from the AWS CLI.Both of these methods use the CLI with SSO, but I thought they were written in separate places in the AWS documentation and were inaccessible, so I summarized them here. How to retrieve credentials from the User Portal This one is very simple. Simply configure the settings using the values displayed.However, an expiration date exists for SSO authentication. (Default is 1 hour and can be extended up to 12 hours by configuration.)Since…<\/p>\n","protected":false},"author":2,"featured_media":64,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"vkexunit_cta_each_option":"","footnotes":""},"categories":[6],"tags":[7,15,14],"class_list":["post-62","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aws","tag-aws","tag-cli","tag-sso"],"_links":{"self":[{"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/posts\/62","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/comments?post=62"}],"version-history":[{"count":4,"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/posts\/62\/revisions"}],"predecessor-version":[{"id":68,"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/posts\/62\/revisions\/68"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/media\/64"}],"wp:attachment":[{"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/media?parent=62"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/categories?post=62"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.interstellar.co.jp\/en\/wp-json\/wp\/v2\/tags?post=62"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}