ºÚÁϺ£½Ç91Èë¿Ú

AWS Command Line Interface (AWS CLI) is a powerful open source tool that enables AWS users to interact with AWS services using the command-line. AWS CLI allows users to implement the same functionality available in the AWS Management console using automated scripts and commands. 

Configuring and using AWS CLI became more streamlined for organizations who are using the AWS IAM Identity Center (successor to AWS SSO) service and AWS CLI v2. With the release of AWS CLI v2, AWS CLI profiles can be linked to AWS IAM Identity Center accounts. Using the ºÚÁϺ£½Ç91Èë¿Ú integration with AWS IAM Identity Center, users can securely log in to AWS CLI with their ºÚÁϺ£½Ç91Èë¿Ú account and ºÚÁϺ£½Ç91Èë¿Ú Multi-Factor Authentication (MFA).

How it works

1. Trigger an AWS SSO login from AWS CLI using a named profile.
2. Log in with your ºÚÁϺ£½Ç91Èë¿Ú credentials and MFA in your default browser.
3. Run your CLI commands using your named profile.

Considerations

• This functionality is only available with AWS CLI v2 or higher.
• ºÚÁϺ£½Ç91Èë¿Ú must be configured as the external identity provider for the AWS IAM Identity Center service.
• SAML 2.0 must be the Authentication method.
• We recommend using SCIM provisioning to provision/deprovision users and manage groups and group membership.

Configuring AWS CLI to use ºÚÁϺ£½Ç91Èë¿Ú for SSO

Configure ºÚÁϺ£½Ç91Èë¿Ú integration with AWS IAM Identity Center

1. Configure the ºÚÁϺ£½Ç91Èë¿Ú SSO integration with the AWS IAM Identity Center service.
2. Optionally, configure the ºÚÁϺ£½Ç91Èë¿Ú Identity Management integration with AWS IAM Identity Center to create, manage, and remove users and groups to simplify role, permission, and policy application.
3. Associate user groups to the configured AWS IAM Identity Center integration in ºÚÁϺ£½Ç91Èë¿Ú.

Assign permissions and policies within each AWS account in AWS IAM Identity Center

1. Login to the AWS management console as an admin.
2. Create new permissions under an account (if applicable):
   • Navigate to AWS IAM Identity Center > AWS accounts > Permission sets.
   • Click Create permission set or click an existing permission set to update it.
   • These permission automatically get created as roles in AWS IAM and are available for all your AWS organizations.
3. Navigate to AWS IAM Identity Center > AWS accounts > AWS organization.
4. Select the account.
5. Click Assign users option or click an user or group set to add permission sets.
6. Click Groups tab to assign permission sets/roles at the group level or Users to assign them at the user level.
7. Check the box next to the group(s) to which you want to add permission.
8. Click Next: Permission sets.
9. Select the or unselect the permission sets or Create new permission set and save changes.
10. Repeat the steps as needed.
11. Users associated with the group(s) will inherit the permission set(s) assigned to the group(s) unless excluded by an Account Based Access Control (ABAC) policy.
12. Navigate to Settings AWS IAM Identity Center > Settings.
13. Note your User portal URL, because you will need it when logging in to AWS CLI.

Create an AWS CLI named profile to use your ºÚÁϺ£½Ç91Èë¿Ú account and ºÚÁϺ£½Ç91Èë¿Ú MFA

1. Launch AWS CLI.
2. Trigger an AWS IAM Identity Center login by running the following command: 

3. Enter your  AWS IAM Identity Center User portal URL at the SSO start URL prompt:

4. Enter your AWS IAM Identity Center region:

5. Your default browser will be launched.

6. Enter your ºÚÁϺ£½Ç91Èë¿Ú credentials.
7. Enter your ºÚÁϺ£½Ç91Èë¿Ú MFA.
8. Select your account.
9. Select the role you want to use for that account.
10. A confirmation of your role selection will appear.
11. Enter your default region:

12. Enter your default output format:

13. Give your profile a name which will be profile name used to sign in and get temporary credentials:

Retrieve and cache temporary AWS credentials using your named profile

1. Run the following command:

2. Your default browser will be launched.

3. Enter your ºÚÁϺ£½Ç91Èë¿Ú credentials.
4. Enter your ºÚÁϺ£½Ç91Èë¿Ú MFA.
5. You  will receive a sign-in confirmation message.
6. AWS temporary credentials are retrieved for the IAM role specified in the named profile and are cached with an expiration timestamp.

Running AWS CLI commands using your named profile temporary credentials

1. Use your cached temporary credentials and your named profile to perform CLI commands:

Sign out and delete cached and temporary credentials

1. Run the following command to sign out and delete all cached SSO credentials and all AWS temporary credentials associated with your ºÚÁϺ£½Ç91Èë¿Ú AWS IAM Identity Center credentials:

Learn more