Using an IAM Role with CLI + SSO

[ydogus]

It would be nice to have some named profiles with SSO which are configured to assume roles: Something similar to role_arn property we use in CLI config file. This way we can have our CLI to assume the roles automatically after using SSO credentials to sign in to AWS services.

I think it's a valid use case. We might still need to assume roles after signing over SSO.

I tried to use role_arn with SSO but it seems it is not working with SSO as it gives me an error of Partial credentials found in assume-role, missing: source_profile or credential_source.

Is this already supported? If yes, can you please direct me to the documentation?

[kdaily]

Hi @ydogus,

I think this should be documented here:

https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html#sso-configure-profile

Under the section "Running a command with your AWS SSO enabled profile", I think this works through the scenario that you are describing.

You can create multiple AWS SSO enabled named profiles that each point to a different AWS account or role. You can also use the aws sso login command on more than one profile at a time. If any of them share the same AWS SSO user account, you must log in to that AWS SSO user account only once and then they all share a single set of AWS SSO cached credentials.

[ydogus]

Hello,

Actually this is not what really I was looking for. I'm aware of named SSO profiles. But what I'm looking for is an equivalent of role_arn parameter for SSO.

With role_arn, CLI simplifies our life by assuming a role. That way I could create profiles for roles that I use with CLI. I've never had to call aws sts assume-role to assume a role and configure my workplace with returned credentials to make my next API calls. A simple --profile foo is more than enough if my config file is well configured.

So I was looking for a similar feature in CLI to simplify to work with assumed roles. For now I can't ask my CLI to make requests by assuming a role if my credentials are provided by SSO. Of course as a workaround I can use aws sts assume-role but this is a little bit complex for an everyday tasks.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.

[lorengordon]

I'm kinda curious about this:

I tried to use role_arn with SSO but it seems it is not working with SSO as it gives me an error of Partial credentials found in assume-role, missing: source_profile or credential_source.

Does it work if you add source_profile pointing to the sso profile? E.g. something like this:

[profile assume]
role_arn = arn:aws:iam::xxxxxx:role/role-to-assume
source_profile = sso

[profile sso]
sso_start_url = https://my-sso-portal.awsapps.com/start
sso_region = us-east-1
sso_account_id = 123456789011
sso_role_name = ssoRole
region = us-east-1

Then first login to the sso profile, but use the assume profile for other commands?

$ aws sso login --profile sso
$ aws sts get-caller-identity --profile assume

If that doesn't work, it seems to me like the SSO implementation would be incomplete, as far as support for the AWS Shared Config goes...?

[ydogus]

Thank you @lorengordon for the example. source_profile did the job.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.

[kdaily]

Thanks @lorengordon, that's the suggestion! Glad you got it working, @ydogus.

[izimbra]

It would be great if this use case was documented on this page: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html#sso-using-profile

[chr1shung]

Does it work if you add source_profile pointing to the sso profile? E.g. something like this:

[profile assume]
role_arn = arn:aws:iam::xxxxxx:role/role-to-assume
source_profile = sso

[profile sso]
sso_start_url = https://my-sso-portal.awsapps.com/start
sso_region = us-east-1
sso_account_id = xxxx
sso_role_name = ssoRole
region = us-east-1

Then first login to the sso profile, but use the assume profile for other commands?

$ aws sso login --profile sso
$ aws sts get-caller-identity --profile assume

If that doesn't work, it seems to me like the SSO implementation would be incomplete, as far as support for the AWS Shared Config goes...?

I'm a new AWS user and trying to follow this practice but got Could not connect to the endpoint URL: "https://sts.<region>.amazonaws.com/" , any idea what did I possibly mis-configure ?
My SSO role is the AWS managed PowerUserAccess