aws-sso-creds

AWS SSO Creds

aws-sso-creds is a terminal UI for AWS IAM Identity Center (formerly AWS SSO). It helps you manage generated AWS profiles, browse them quickly, and open the AWS console from your active profile without manually editing ~/.aws/config and ~/.aws/credentials.

1. Install the CLI.
2. Create your config interactively:

aws-sso-creds init

If you use the CLI often, these shell aliases remove most of the repetitive typing:

alias ao='aws-sso-creds open'
alias aps='eval "export AWS_PROFILE=$(aws-sso-creds select)"'
alias ac='aws-sso-creds -p'

• aps runs aws-sso-creds select and exports the selected profile for you, so you do not need to run export AWS_PROFILE=... manually.
• ao is a short alias for aws-sso-creds open.
• ac is a short alias for aws-sso-creds -p, which populates roles for the organization you pass in.

3. Generate profiles for one configured organization:

aws-sso-creds my-org --populateRoles

4. Pick and export a profile in one step:

aps

This is equivalent to:

export AWS_PROFILE=$(aws-sso-creds select)

5. Open the AWS console for the active profile:

ao

Manual equivalent:

export AWS_PROFILE=my-org-admin
aws-sso-creds open

• Creates and maintains an aws-sso-creds.toml config file.
• Populates AWS profiles in ~/.aws/config.
• Creates temporary credentials in ~/.aws/credentials when requested.
• Lets you browse generated profiles in a fuzzy finder.
• Opens the AWS console using the profile in AWS_PROFILE.

Download a binary for your platform from the GitHub releases page.

Prerequisite: Go 1.17+

Release PRs keep this version updated automatically:

go install github.com/JorgeReus/aws-sso-creds@1.4.3

git clone https://github.com/JorgeReus/aws-sso-creds.git
cd aws-sso-creds
go build ./...

Run lint locally:

mise lint

Run tests locally:

mise test

Install from this repo:

nix profile install github:JorgeReus/aws-sso-creds

Run without installing permanently:

nix run github:JorgeReus/aws-sso-creds

Use it as a flake input:

{
  inputs = {
    aws-sso-creds.url = "github:JorgeReus/aws-sso-creds";
  };
}

Then expose the package from your outputs:

{
  outputs = { self, nixpkgs, aws-sso-creds, ... }:
    let
      system = "aarch64-darwin";
    in
    {
      packages.${system}.default = aws-sso-creds.packages.${system}.default;
    };
}

By default, aws-sso-creds reads ~/.config/aws-sso-creds.toml.

Example:

error_color = "#fa0718"
information_color = "#05fa5f"
warning_color = "#f29830"
focus_color = "#4287f5"
spinner_color = "#42f551"

[organizations.org1]
url = "https://org1.awsapps.com/start"
prefix = "org1"
sso_region = "us-east-1"
default_region = "us-west-2"

[organizations.org2]
url = "https://org2.awsapps.com/start"
prefix = "org2"
sso_region = "us-west-2"

Required fields per organization:

• url: AWS start URL for the IAM Identity Center organization
• prefix: Prefix used for generated AWS profiles
• sso_region: Region for the IAM Identity Center organization

Optional fields:

• default_region: Default AWS region written to generated profiles
• region: Legacy fallback. If sso_region is missing, region is used as the SSO region

Create or update the config interactively:

aws-sso-creds init

init prompts for:

• organization name
• AWS start URL
• prefix
• SSO region
• default AWS region, optional

aws-sso-creds init

This writes or updates ~/.config/aws-sso-creds.toml.

aws-sso-creds my-org --populateRoles

This loads the configured organization, authenticates if needed, and writes AWS SSO profiles to ~/.aws/config.

aws-sso-creds my-org --temp

Use this when you want temporary credentials written to ~/.aws/credentials.

aws-sso-creds my-org --forceAuth

Use this when cached authentication is stale or you want to re-authenticate explicitly.

aws-sso-creds my-org --noBrowser

Use this when you want to complete the flow without auto-launching a browser window.

aws-sso-creds select

This opens a fuzzy finder previewer for entries in your AWS config and credentials files, then prints the selected profile name to stdout.

export AWS_PROFILE=my-org-admin
aws-sso-creds open

open requires AWS_PROFILE to be set to a profile previously generated by this CLI.

Root command:

aws-sso-creds [flags] [organization]

Subcommands:

• init: create or update the config interactively
• select: choose a profile from the fuzzy finder
• open: open the AWS web console for AWS_PROFILE
• completion: generate shell completions

Root flags:

• -c, --config: path to the TOML config file
• -f, --forceAuth: force authentication with AWS SSO
• -b, --noBrowser: do not open the browser automatically
• -p, --populateRoles: populate AWS SSO roles in ~/.aws/config
• -t, --temp: create temporary credentials in ~/.aws/credentials

Run aws-sso-creds --help or aws-sso-creds [command] --help for the full CLI help text.

When you run aws-sso-creds --help or aws-sso-creds help, the root help output also shows the build version. Local builds without release metadata show Version: dirty; release binaries show the release tag.

Pull requests are welcome.

1. Fork the repository.
2. Create a feature branch.
3. Commit using Conventional Commits.
4. Push the branch.
5. Open a pull request.

• Pull requests run GitHub Actions CI with go test ./....
• Pull request commits must follow Conventional Commits so semantic versioning can be derived automatically.
• Pushes to main do not publish a release directly.
• Pushes to main run release-please, which opens or updates a release PR and creates the next X.Y.Z tag when that PR is merged.
• Semver tags matching X.Y.Z run GoReleaser and publish GitHub release artifacts.
• Configure a RELEASE_PLEASE_TOKEN repository secret backed by a PAT or GitHub App token. The default GITHUB_TOKEN does not trigger the tag-based release workflow when release-please creates the tag.

Distributed under the MIT License. See LICENSE for details.

Jorge Reus - LinkedIn

• TLDR Legal
• Build your own Gopher
• Bubbles components
• Python implementation of this tool
• Best README Template