ssowrap is a single binary tool that run a command using AWS SSO credentials.
Note
In most cases it is better to use aws configure export-credentials.
brew install winebarrel/ssowrap/ssowrapUsage: ssowrap --aws-profile=STRING <command> [flags]
Arguments:
<command> Command and arguments.
Flags:
-h, --help Show help.
--aws-profile=STRING AWS CLI profile ($AWS_PROFILE).
--aws-config-file="~/.aws/config" AWS CLI config file location ($AWS_CONFIG_FILE).
--awssso-cache-dir="~/.aws/sso/cache" AWS SSO token cache dir location ($AWS_SSO_CACHE_DIR).
--version
$ export AWS_PROFILE=my-profile
$ aws sso login
$ ssowrap env | grep ^AWS_
$ cat ./list-users.sh
#!/bin/sh
curl -L "https://iam.amazonaws.com/?Action=ListUsers&Version=2010-05-08" \
--aws-sigv4 "aws:amz:us-east-1:iam" \
--user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" \
-H "X-Amz-Security-Token: $AWS_SESSION_TOKEN"
# Call AWS IAM API using curl with AWS SSO credentials.
$ ssowrap ./list-users.sh