AWS SSO

July 6, 2022 1 min read aws, sso

Written in 2022. Tools, APIs and prices may have changed since.

Lab note What I wrote down while learning this by building with it. Short by design; the code is in pfeilbr/aws-sso-playground.

SSO Access Token

The aws sso CLI commands require the --access-token parameter. First login via sso (e.g. aws sso login), then run the following to get.

# get cached aws sso accessToken
function aws-access-token() { cat $(ls -1d ~/.aws/sso/cache/* | grep -v botocore) |  jq -r "{accessToken} | .[]" }

Demo

list account assignments (AWS::SSO::Assignment)

aws sso-admin list-account-assignments \
    --instance-arn 'arn:aws:sso:::instance/ssoins-72234101455cbc87' \
    --account-id '123456789012' \
    --permission-set-arn 'arn:aws:sso:::permissionSet/ssoins-72234101455cbc87/ps-51eacb02632f0b26'

{
    "AccountAssignments": [
        {
            "AccountId": "123456789012",
            "PermissionSetArn": "arn:aws:sso:::permissionSet/ssoins-72234101455cbc87/ps-51eacb02632f0b26",
            "PrincipalType": "USER",
            "PrincipalId": "906770ec60-e34082a0-033a-4dd2-90cb-9107804545e9"
        },
        {
            "AccountId": "123456789012",
            "PermissionSetArn": "arn:aws:sso:::permissionSet/ssoins-72234101455cbc87/ps-51eacb02632f0b26",
            "PrincipalType": "USER",
            "PrincipalId": "906770ec60-9d6f0b65-701c-4650-b95c-7dab0f6046d7"
        }
    ]
}

Resources

Keep learning