Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add documentation on assuming a role with SSO #1239

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add documentation on assuming a role with SSO #1239

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions USAGE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@
- [MFA](#mfa)
- [Gotchas with MFA config](#gotchas-with-mfa-config)
- [Single Sign On (SSO)](#single-sign-on-sso)
- [Assuming a role with SSO](#assuming-a-role-with-sso)
- [Assuming roles with web identities](#assuming-roles-with-web-identities)
- [Using `credential_process`](#using-credential_process)
- [Invoking `aws-vault` via `credential_process`](#invoking-aws-vault-via-credential_process)
Expand Down Expand Up @@ -584,6 +585,22 @@ sso_account_id=123456789012
sso_role_name=Administrator
```

### Assuming a role with SSO

If your SSO permission set permits you to assume another IAM role, (other than the IAM role autogenerated by your permission set,) you can do that by using the `source_profile` option. Here's an example:

```ini
[profile Administrator-123456789012]
sso_start_url=https://aws-sso-portal.awsapps.com/start
sso_region=eu-west-1
sso_account_id=123456789012
sso_role_name=Administrator

[profile Role-abc]
role_arn=arn:aws:iam::123456789012:role/Role-abc
source_profile=Administrator-123456789012]
```

## Assuming roles with web identities

AWS supports assuming roles using [web identity federation and OpenID Connect](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html#cli-configure-role-oidc), including login using Amazon, Google, Facebook or any other OpenID Connect server. The configuration options are as follows:
Expand Down