Add support for AWS Single Sign-On

[brandond]

AWS recently released a SSO service that integrates with Organizations and the AWS Directory Service:
https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

Currently, the only way to consume this service is via a browser. Shortcuts are provided to copy and paste shell commands to export the appropriate environment variables, but this is unacceptable. Users should not need to use a web browser to authenticate with CLI tools.

Other tools such as aws-adfs exist to do this for ADFS, Octa, etc, but there are not currently any for AWS SSO. Since this is a first-party AWS service, aws-cli should support it.

[justnance]

@brandond, Thank you for reaching out. This seems like a reasonable feature request marking the label as such. Can you tell me more how you would like this feature to work or provide an example. Thanks.

[brandond]

Other tools in this space use interactive prompts, much like the aws configure command. The work flow is generally something along the lines of:

• Prompt for username
• Prompt for password
• Prompt for MFA code (if necessary)
• Make login call to SSO service, enumerate available roles, retrieve SAML assertion
• Parse SAML assertion to discover available roles
• Prompt to select role
• Make STS:AssumeRoleWithSAML call
• Store temporary credentials returned by STS to profile (~/.aws/credentials)

I haven't been able to find any documentation on APIs for configuring or consuming SSO, but a quick look at the developer tool network log in my browser indicates that there is a REST service behind the console.

[justnance]

@brandond, Thank you for your feedback. It sound reasonable and this issue will remain labeled as feature request. Thanks.

[hassankhan]

+1 to this, would make our lives much easier

We need CLI support. Right now our devs are stuck logging in and out of the SSO screen to get credentials every hour.

[angusfz]

+1 For this feature

[Kim725]

+1 For this feature

[jonatasalves-hotmart]

+1 For this feature

[Zordrak]

100% required.

[Photon0gen]

+1

[akr257]

+1 for this feature. AWS SSO became available in our region (Sydney), but sadly it doesn't look like we can use it until the aws cli supports gaining access programatically.