saml2aws enables users to authenticate with AWS using SAML (Security Assertion Markup Language) with supported Identity Providers like ADFS, PingFederate, and Okta. It retrieves temporary AWS credentials, simplifying access management and eliminating the need for manual credential management. The tool leverages existing SAML infrastructure to obtain AWS credentials, enhancing security and streamlining workflows. It relies on the playwright-go library for browser-based SAML authentication.
saml2aws simplifies AWS credential management by leveraging SAML, reducing the need for manual configuration and caching. It supports multiple Identity Providers, offering flexibility in environment integration. The tool provides a command-line interface for easy integration with scripts and automation workflows. It offers a flexible approach to handling AWS tokens with customizable duration and integration with regional endpoints for improved security.
- Core Functionality: Retrieves temporary AWS credentials via SAML authentication from various IDPs.
- Supported Platforms: Linux, macOS, Windows (via Chocolatey, Homebrew, or manual installation).
- Configuration: Configurable with various SAML providers and options for specifying IDP accounts.
- Security: Supports various MFA mechanisms and allows configuring regional STS endpoints for enhanced security.
- Developer Experience: Provides a command-line interface and can be integrated into scripts for automation.
The project is actively maintained with recent commits and addresses issues with various IDPs. Installation instructions are provided for major operating systems. Documentation covers configuration and usage cases. However, some providers rely on screen scraping, which may require adjustments.
saml2aws benefits system administrators and developers who need to automate or simplify AWS access for multiple users or systems. It's ideal for environments with existing SAML infrastructure, eliminating the need for complex IAM role management. It provides a secure and efficient way to obtain temporary AWS credentials for various use cases.