Azure ad sso login to aws cli
title: 'Azure AD SSO Login to AWS CLI'
title: 'Azure AD SSO Login to AWS CLI' date: '2019-04-18T15:53:57-05:00' status: publish permalink: /azure-ad-sso-login-to-aws-cli author: admin excerpt: '' type: post id: 1343 category: - Uncategorized tag:  post_format: 
Note out of scope here is setting up the services itself. This article is about using a Node application to login to Azure on a client and then being able to use the AWS CLI. Specifically this information applied to a Linux desktop.
Setting up the services are documented here: https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/amazon-web-service-tutorial
We are following this tutorial https://github.com/dtjohnson/aws-azure-login and focussed on one account having an administrative role and then switching to different accounts which allows the original role to administer resources.
Linux Lite 4.4 OS Setup
</div>**Configure Named Profile (First Time)** <div class="wp-block-syntaxhighlighter-code ">``` $ aws-azure-login --profile awsaccount1 --configure Configuring profile ‘awsaccount1’ ? Azure Tenant ID: domain1.com ? Azure App ID URI: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx ? Default Username: email@example.com ? Default Role ARN (if multiple): arn:aws:iam::xxxxxxxxxxxx:role/awsaccount1-Admin-Role ? Default Session Duration Hours (up to 12): 12 Profile saved.
Login with Named Profile
</div>**Update Credentials File For Different Accounts to Switch Roles To** <div class="wp-block-syntaxhighlighter-code ">``` $ cat .aws/credentials [awsaccount2] region=us-east-1 role_arn=arn:aws:iam::xxxxxxxxxxxx:role/awsaccount1-Admin source_profile=awsaccount1 [awsaccount3] region=us-east-1 role_arn=arn:aws:iam::xxxxxxxxxxxx:role/awsaccount1-Admin source_profile=awsaccount1 [awsaccount1] aws_access_key_id=XXXXXXXXXXXXXXXXXXXX aws_secret_access_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX aws_session_token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx==" aws_session_expiration=2019-04-18T10:22:06.000Z
So next time just login with the named profile awsaccount1 and you have AWS CLI to the other accounts. Note you will need to make sure ARN's and roles etc are 100% accurate. It gets a bit confusing.
Also this is informational and you carry your own risks of accessing the wrong account.