moritzheiber/saml2aws

saml2aws is a command-line tool that lets you log into Amazon Web Services using your company's existing identity system, things like Microsoft ADFS, Okta, PingFederate, Google Apps, or KeyCloak. Instead of dealing with long-lived access keys that can be a security risk, you get temporary credentials that expire automatically, usually within an hour. The practical benefit is straightforward: you can use the AWS command-line tools the same way you'd use any other terminal command, authenticated through the same login you already use for email and internal company systems. The tool walks you through a login prompt, talks to your identity provider behind the scenes, and trades that login for a short-lived set of AWS credentials. It saves those credentials under a named profile so your other AWS tools pick them up automatically. You can configure multiple named accounts if you work across different AWS environments, say, a dev account and a test account, which helps prevent accidentally running commands against the wrong infrastructure. There are also helper commands to open the AWS web console directly after logging in, or to run a specific command with the temporary credentials applied. The main audience is operations staff, developers, or anyone who needs command-line access to AWS but whose company enforces single sign-on through a SAML-based identity provider. A typical use case would be an engineer who needs to run infrastructure scripts or deploy code to AWS but doesn't want to manage permanent access keys. It's especially useful in organizations with multiple AWS accounts and roles, since you can configure separate profiles for each environment and even pre-select which role to assume on login. One tradeoff worth noting: the project relies heavily on screen scraping for most providers, meaning it essentially simulates a browser login rather than using a clean official API. The developers acknowledge this isn't ideal and hope vendors make it easier over time. Session length defaults to an hour but can be extended up to twelve hours via a flag, and multi-factor authentication is supported across several providers.