How to setup awscli2 with Fedora's SSO

[xsuchy]

I am a member of Fedora infrastructure and we use AWS EC2. To webUI I log using SSO. It is documented here https://docs.fedoraproject.org/en-US/infra/sysadmin_guide/aws-access/#_accessing_the_aws_console

To log in there I use https://id.fedoraproject.org/saml2/SSO/Redirect?SPIdentifier=urn:amazon:webservices&RelayState=https://console.aws.amazon.com

this works perfectly.
Recently, I tried to use awscli2 to script some tasks. But I struggle with how to configure it. And no one around me knows.

I run aws configure sso but I had a hard time filling SSO start URL as nothing that I entered there works.

Any idea how to configure it?

[RyanFitzSimmonsAK]

Hi @xsuchy, thanks for reaching out. Here is the documentation regarding configuring the CLI to use SSO credentials : https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html. SSO start URL should be the start URL of your access portal. Please let me know if you have any follow-up questions. Thanks!

[xsuchy]

$ aws configure sso
SSO session name (Recommended): fedora
SSO start URL [None]: https://accounts.fedoraproject.org/
SSO region [None]: us-east-1
SSO registration scopes [sso:account:access]:

An error occurred (InvalidRequestException) when calling the StartDeviceAuthorization operation: 

I tried https://id.fedoraproject.org/ as well, did not work too.

[indrora]

According to the documentation that you linked, your organization is using a linked role to access the AWS Console, and that to gain CLI access you should set up a user with the same name as the role you are assigned:

if you need cli access, you will need a user and a token. Users should be named the same as the role they are associated with.

This appears to say "use IAM to create a user with the same name as the role you are associated with and create a Secret/Access key from there." Confirm with your organization, however.