Aller au contenu

AWS - Connect to consoles#

SAML Web login#

Connect to console: Federated login URL.

This page shows the roles a user can assume for all the Caascad managed AWS accounts.

AWS login page

Once selected, the role is assumed, as shown in the upper right corner:

AWS login info

SAML CLI login#

Prerequisites#

Install the saml2aws tool to easily manage temporary credentials:

toolbox install saml2aws

Configuration#

At this point, we recommend you configure a login profile for each AWS account if you want to perform cross account requests at the same time.

The following commands configure 2 login profiles each bound to an AWS profile.

caascad-dev

saml2aws configure -a caascad-dev --session-duration 28800 --url=https://keycloak.corp.caascad.com/realms/corp/protocol/saml/clients/aws-caascad-idp-saml -p caascad-dev --idp-provider=KeyCloak
? Please choose a provider: KeyCloak
? AWS Profile caascad-dev
? URL https://keycloak.corp.caascad.com/realms/corp/protocol/saml/clients/aws-caascad-idp-saml
? Username XXXXXXX
? Password *********
? Confirm *********

account {
  URL: https://keycloak.corp.caascad.com/realms/corp/protocol/saml/clients/aws-caascad-idp-saml
  Username: XXXXXXX
  Provider: KeyCloak
  MFA: Auto
  SkipVerify: false
  AmazonWebservicesURN: urn:amazon:webservices
  SessionDuration: 28800
  Profile: caascad-dev
  RoleARN:
}

Configuration saved for IDP account: caascad-dev

caascad-prod

saml2aws configure -a caascad-prod --session-duration 28800 --url=https://keycloak.corp.caascad.com/realms/corp/protocol/saml/clients/aws-caascad-idp-saml -p caascad-prod --idp-provider=KeyCloak
? Please choose a provider: KeyCloak
? AWS Profile caascad-prod
? URL https://keycloak.corp.caascad.com/realms/corp/protocol/saml/clients/aws-caascad-idp-saml
? Username XXXXXXX
? Password *********
? Confirm *********

account {
  URL: https://keycloak.corp.caascad.com/realms/corp/protocol/saml/clients/aws-caascad-idp-saml
  Username: XXXXXXX
  Provider: KeyCloak
  MFA: Auto
  SkipVerify: false
  AmazonWebservicesURN: urn:amazon:webservices
  SessionDuration: 28800
  Profile: caascad-prod
  RoleARN:
}

Configuration saved for IDP account: caascad-prod

Usage#

Login#

The temporary credentials are valid for 8 hours.

To (re)generate them:

saml2aws -a caascad-dev login
saml2aws -a caascad-prod login

Using AWS CLI#

toolbox install awscli

Then:

aws --profile caascad-dev ec2 describe-regions --region eu-west-3

Or

export AWS_PROFILE=caascad-dev
aws ec2 describe-regions --region eu-west-3

Open console from CLI#

saml2aws -a caascad-dev console