saml2aws VS awsume

related: message on saml2aws repo

If you have an external identity provider, you can add a SAML provider in IAM and use saml2aws locally. The session duration can be configured on the role.

Or if you have an existing IdP you can use https://github.com/Versent/saml2aws and https://github.com/makethunder/awsudo. By setting up a central account that you put in your trust policy which users can assume roles.

In my company everything goes through Active Directory and we use saml2aws [1] to generate credentials with two factor involved. It works quite well for us. We even use this for our artists to create local builds of our games since we keep all important secrets and such in aws secrets mananger. We scope access to said secrets with custom roles and tags.

[1] https://github.com/Versent/saml2aws

Technically I guess it should be possible with something like saml2aws, but it doesn't support AWS as an IdP yet.

saml2aws-multi is a simple tool I created for using saml2aws more effectively on day-to-day tasks. saml2aws-multi provides an easy-to-use command line interface to support login and retrieve AWS temporary credentials for multiple roles of different accounts with saml2aws.

I have used awsume a long time. Then I got a new Macbook and lost 1/2 hour installing different python versions. So I programmed switchaws in go to get a single executable. And, yes: I declare guilty of the "not invented here" syndrom :) .

Bonus comment: After setting up your aws credentials, have a look at awsume, which makes rapid switches between accounts and roles a lot easier.. :)

Has anyone on AWS gotten k9s to work with Awsume [0] authentication?

[0] https://awsu.me/

Learn how to WORK with AWS well, for instance set up Awsume (https://awsu.me/, install the Switch Roles extension (https://chrome.google.com/webstore/detail/aws-extend-switch-roles/jpmkfafbacpgapdghgdpembnojdlgkdl). Try to make working with it as painless as possible. I went through a long phase of bitching and hating AWS but I've recently just given in.

Haven’t tried Leapp, not sure how I’d feel about needing to swap to a UI every time. I’m a huge fan of Awsume

💡 When working with different accounts and/or roles and enabled MFA, it's recommendable to get some tooling support. I love working with AWSume in this case. It's easy to set up and really intuitive to work with.

Together with awsume and cdkstat I can have a terminal dashboard if a want to monitor the deployment on multiple accounts: