The aim for this is to create a general purpose CLI OIDC login with a limited set of trusted dependencies.
Tested with Azure AD for now. Your mileage may vary with other providers, please let us know!
- Create Azure AD App
- Set public client reply url to
http://localhost
- Add an appRole (may be unnecessary)
- Add users(s) to the role (to the app)
- Set public client reply url to
- Create an AWS OIDC identity provider
- Authority URL will be
https://login.microsoftonline.com/<AAD tenant id>/oauth2/v2.0
- Add your AAD app client id as audience
- Authority URL will be
- Create a web identity role with permissions you'd like
- Edit trust relationship for the role to allow role assumption with tokens issued by AAD for your app
- Add parameters under a suitable profile ~/.aws/config:
- Add your application id (client id) from AAD app
- Add your AAD tenant id
oidc_authority_url=https://login.microsoftonline.com/<AAD tenant id>/oauth2/v2.0
oidc_client_id=<id of your AAD app>
oidc_role_arn=<ARN of the role you are assuming on AWS>
It's available on PyPI. Install by running pip install aws-oidc-login
.
The executable is called aol
. Log in with default profile by simply running aol
or specify a profile with aol [profile]
.
See aol -h
for more options.