search

common-fate / granted

The easiest way to access your cloud.
https://granted.dev
MIT License
955 stars 90 forks source link

Add support for sso-session to populate/generate command #670

Open simpson-ross opened 1 month ago

simpson-ross commented 1 month ago

In https://github.com/common-fate/granted/pull/530 support was added to read sso-session from the AWS config file, which allows the use of multiple users within a single AWS SSO system.

The granted CLI doesn't know about sso-session, so getting it to work is tedious. Here are the steps I followed to manage two users, user1 and user2:

  1. Add a [sso-session] stanza to the AWS config for user1.
  2. Run granted sso populate ..., logging in to AWS with user1.
  3. Post-process the AWS config to add sso_session = user1 to each generated profile.
  4. Run granted sso-tokens clear --all to remove the existing "default" session.
  5. Repeat above steps for user2, adding a different prefix to the generated role names

It would be great if granted sso generate could take an optional sso-session parameter and, if set, append it to the generated profiles:

$ granted sso generate --sso-region us-east-1 --sso-session user1 https://foo.awsapps.com/start
[i] listing available profiles from AWS IAM Identity Center...
 100% |█████████████████████████████████████████████████████████████████████████████████████████████| (22/22, 2 it/s)
[profile Prod.Developer]
sso_start_url              = https://foo.awsapps.com/start
sso_region                 = us-east-1
sso_account_id             = 111111111111
common_fate_generated_from = aws-sso
sso_role_name              = Developer
sso_session                = user1