Azure ad sso login to aws cli
wordpress meta
title: 'Azure AD SSO Login to AWS CLI'
date: '2019-04-18T15:53:57-05:00'
status: publish
permalink: /azure-ad-sso-login-to-aws-cli
author: admin
excerpt: ''
type: post
id: 1343
category:
- Uncategorized
tag: []
post_format: []
title: 'Azure AD SSO Login to AWS CLI'
date: '2019-04-18T15:53:57-05:00'
status: publish
permalink: /azure-ad-sso-login-to-aws-cli
author: admin
excerpt: ''
type: post
id: 1343
category:
- Uncategorized
tag: []
post_format: []
Note out of scope here is setting up the services itself. This article is about using a Node application to login to Azure on a client and then being able to use the AWS CLI. Specifically this information applied to a Linux desktop.
Setting up the services are documented here: https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/amazon-web-service-tutorial
We are following this tutorial https://github.com/dtjohnson/aws-azure-login and focussed on one account having an administrative role and then switching to different accounts which allows the original role to administer resources.
Linux Lite 4.4 OS Setup
</div>**Configure Named Profile (First Time)**
<div class="wp-block-syntaxhighlighter-code ">```
$ aws-azure-login --profile awsaccount1 --configure
Configuring profile ‘awsaccount1’
? Azure Tenant ID: domain1.com
? Azure App ID URI: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
? Default Username: myaccount@domain1.com
? Default Role ARN (if multiple):
arn:aws:iam::xxxxxxxxxxxx:role/awsaccount1-Admin-Role
? Default Session Duration Hours (up to 12): 12
Profile saved.
Login with Named Profile
</div>**Update Credentials File For Different Accounts to Switch Roles To**
<div class="wp-block-syntaxhighlighter-code ">```
$ cat .aws/credentials
[awsaccount2]
region=us-east-1
role_arn=arn:aws:iam::xxxxxxxxxxxx:role/awsaccount1-Admin
source_profile=awsaccount1
[awsaccount3]
region=us-east-1
role_arn=arn:aws:iam::xxxxxxxxxxxx:role/awsaccount1-Admin
source_profile=awsaccount1
[awsaccount1]
aws_access_key_id=XXXXXXXXXXXXXXXXXXXX
aws_secret_access_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
aws_session_token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=="
aws_session_expiration=2019-04-18T10:22:06.000Z
Test Access
So next time just login with the named profile awsaccount1 and you have AWS CLI to the other accounts. Note you will need to make sure ARN's and roles etc are 100% accurate. It gets a bit confusing.
Also this is informational and you carry your own risks of accessing the wrong account.