saml2aws VS aws-mfa

related: message on saml2aws repo

If you have an external identity provider, you can add a SAML provider in IAM and use saml2aws locally. The session duration can be configured on the role.

Or if you have an existing IdP you can use https://github.com/Versent/saml2aws and https://github.com/makethunder/awsudo. By setting up a central account that you put in your trust policy which users can assume roles.

In my company everything goes through Active Directory and we use saml2aws [1] to generate credentials with two factor involved. It works quite well for us. We even use this for our artists to create local builds of our games since we keep all important secrets and such in aws secrets mananger. We scope access to said secrets with custom roles and tags.

[1] https://github.com/Versent/saml2aws

Technically I guess it should be possible with something like saml2aws, but it doesn't support AWS as an IdP yet.

saml2aws-multi is a simple tool I created for using saml2aws more effectively on day-to-day tasks. saml2aws-multi provides an easy-to-use command line interface to support login and retrieve AWS temporary credentials for multiple roles of different accounts with saml2aws.

I will tell you that some tools like sceptre and terraform barf using a profile with mfa like this and I ended up using aws-mfa: https://github.com/broamski/aws-mfa and run this for example to create a "dynamic" runamok-power profile:

I use MFA so store a long term key that is used to generate a temporary key. I use this tool to do the mfa: https://github.com/broamski/aws-mfa

I too, struggled with aws-vault and eventually gave up and use https://github.com/broamski/aws-mfa. If you want to take it one step further you can use oathtool and store the totp key in the encrypted vault of your choice. That is still MFA but if you store the factors on the same system you will need to decide about that risk before going the oathtool route.

The built in CLI MFA solution sucks if you have a workflow that relies on named profiles. We use them heavily at work and implemented aws-mfa to make it so that all of our stuff could work without adopting ridiculous workflows.