aws-sso-util VS aws-cloudformation-templates

This tool allows you to configure all accounts your SSO has access to as well as login to all of them at once: https://github.com/benkehoe/aws-sso-util

I just wanted to give a shout out to the maintainers of https://github.com/benkehoe/aws-sso-util . It fills in so many little gaps with AWS SSO (which itself may be a bit clunky, but is a service I wish more people made use of). If you're using CloudFormation to manage SSO access to various organisation accounts, this project provides a really great CloudFormation Macro to make everything easier.

AWS SSO prevents the need to store credentials on disk. Adding and removing users from a group dynamically changes their permissions, and you can customise the maximum session durations. There are some shortcomings with the service, and if you want to get more involved, it's worth checking out aws-sso-util by Ben Kehoe.

Only in rare cases where I work with tooling that can't support SSO vended credentials do I configure my .config profiles with a credential helper script like Ben's stuff over at https://github.com/benkehoe/aws-sso-util

There's some extra documentation on their github as well as a cloudformation template you can deploy from.

I'm deploying a couple of FortiGate VMs in AWS. I've fiddled with the Cloudformation templates from the Fortinet Github repository, and got everything working, in as much as it runs and fails over across two AZs. It's the design from https://github.com/fortinet/aws-cloudformation-templates/tree/main/FGCP/6.4/DualAZ