- Newest
- Most votes
- Most comments
The first link was helpful, (Configure the AWS CLI to use IAM Identity Center token provider credentials with automatic authentication refresh), but using a session while developing sucks a little. It means that I have to add code to use a specific profile to create the session in my dev environment, which I remove in production (those ec2 instances have access via roles).
This must be a solved problem? I guess I can use the parameter store or something similar, but still. I'd love to know how others do it.
For future readers, this is how you do it after creating your Identity Center user with permissions and such like, and after you have set up AWS CLI with aws configure:
In the command line do the following, following the prompts:
$ aws configure sso
SSO session name (Recommended): my-sso
....
After setting up the session, you then use it as follows (I named my profile administrator in the previous step):
Example in AWS CLI:
$ aws dynamodb list-tables --profile administrator
Output:
{
"TableNames": [
"MyTables"
]
}
Example using boto3:
import boto3
session = boto3.Session(profile_name='administrator')
dynamodb = session.client(service_name='dynamodb')
tables = dynamodb.list_tables()['TableNames']
print("DynamoDB Tables:", tables)
Output:
DynamoDB Tables: ['MyTables']
Have fun!
Hello,
No, you can configure the region access the AWS resources in eu-central-1 . Example aws sso config might look like this
[profile my-sso-profile]
sso_start_url = https://my-sso-portal.awsapps.com/start
sso_region = eu-north-1
sso_account_id = 123456789012
sso_role_name = AdministratorAccess
region = eu-central-1
output = json
Refer the documentation to correctly configure the AWS SSO: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html
If you need to access DynamoDB from your local machine and use the newly configured SSO (Identity Center) use this: https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html
If you need to access DynamoDB from some EC2 instance, use IAM Rore (Instance Profile) for that:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html
