Introduction

AWS Single Sign-On (SSO) simplifies managing access to AWS accounts and applications at scale. It allows users to sign in with a single set of credentials to access multiple accounts and applications. However, developers often require access to AWS services through the AWS CLI or SDK, where credentials are typically set as environment variables. This article delves into how to use AWS SSO to store and retrieve these credentials as environment variables to seamlessly integrate with AWS CLI and SDKs.

Understanding AWS SSO

AWS SSO provides centralized access management across AWS services. It offers the following benefits:

• Centralized User Management: Administrators can manage user identities and permissions in one place.
• Single Source of Authentication: Users authenticate once to access multiple AWS accounts and other applications.
• Integration with Identity Providers: It supports integration with existing SAML 2.0 identity providers for authentication.
• Federated Access: Users gain federated access to AWS Management Console and CLI.

Setup AWS SSO

Prerequisites

1. AWS SSO Enabled: Ensure AWS SSO is enabled in your AWS Organization.
2. AWS CLI v2: AWS CLI v2 is required for SSO login.
3. An Identity Source: AWS SSO must be configured to use an identity source.

SSO Configuration

Configure AWS SSO in your AWS administrator account.

1. Access AWS SSO: Go to AWS SSO in the AWS Management Console.
2. Set Up Identity Source: Choose an identity source, such as AWS SSO, External Identity Provider, or Active Directory.
3. Configure User Permissions: Define user roles and permission sets tailored for different AWS accounts and applications.

Configuring AWS CLI for SSO

To authenticate and use AWS services with AWS SSO via the CLI, you must define profiles using the `aws` CLI.

Define an SSO Profile

The following example demonstrates how to configure the AWS CLI to use AWS SSO:

• `SSO session name`
• `SSO region`
• `SSO URL`
• `SSO Role name`
• `Account ID`
• `AWS Region`