Single Sign On (SSO)

AWS IAM Identity Center provides single sign on, and was previously known as AWS SSO.

If your organization uses AWS IAM Identity Center for single sign on, AWS Vault provides a method for using the credential information defined by aws sso from v2 of the AWS CLI. The configuration options are as follows:

• sso_session Name of the [sso-session] section in the same file with the common options, or:
• sso_start_url The URL that points to the organization’s AWS IAM Identity Center user portal.
• sso_region The AWS Region that contains the AWS IAM Identity Center user portal host. This is separate from, and can be a different region than the default CLI region parameter.
• sso_account_id The AWS account ID that contains the IAM role that you want to use with this profile.
• sso_role_name The name of the Identity Center Permission Group that defines the user’s permissions when using this profile.

Here is an example configuration using AWS IAM Identity Center for single sign on:

[profile Administrator-123456789012]
sso_start_url=https://aws-sso-portal.awsapps.com/start
sso_region=eu-west-1
sso_account_id=123456789012
sso_role_name=Administrator

Assuming a role with SSO

If your SSO Permission Set allows you to assume another IAM role (other than the IAM role auto-generated by your permission set), you can do that by using the source_profile option. Here’s an example:

[profile Administrator-123456789012]
sso_start_url=https://aws-sso-portal.awsapps.com/start
sso_region=eu-west-1
sso_account_id=123456789012
sso_role_name=Administrator

[profile AnotherRole-123456789013]
role_arn=arn:aws:iam::123456789013:role/AnotherRole
source_profile=Administrator-123456789012]