AWS Console

🔗 Generate a temporary login URL for the AWS Console

Installation

Release artifact

Binaries for various architectures are published on the releases page.

The latest release can be installed by running:

OS=$(uname | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
curl -Lso aws-console.tar.gz https://github.com/joshdk/aws-console/releases/latest/download/aws-console-${OS}-${ARCH}.tar.gz
tar -xf aws-console.tar.gz
sudo mkdir -p /usr/local/bin/
sudo install aws-console /usr/local/bin/

Brew

Release binaries are also available via Brew.

The latest release can be installed by running:

brew tap joshdk/tap
brew install joshdk/tap/aws-console

Go install

Installation can also be done directly from this repository.

The latest commit can be installed by running:

go install github.com/joshdk/aws-console@master

Usage

Configs and Credentials

This tool generates temporary login URLs for the AWS Console using the credentials from a named AWS cli profile.

The configuration files for these named profiles are located at ~/.aws/credentials and ~/.aws/config. For more information on these two file and configuring profiles, please take a look at:

• https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html
• https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html

User Federation

In the likely event that a named profile provides credentials for an IAM user (opposed to an IAM role), that user must first be federated to obtain temporary credentials. AWS does not permit generating a Console login URL using IAM user credentials, which is why federating users is necessary. For more information on federating credentials, please take a look at:

• https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html

This tool will detect and automatically federate IAM users transparently.

Examples

Generate an AWS Console login URL for the default profile:

$ aws-console

Or for the named "production" profile:

$ aws-console production

Or from the output of the aws cli itself:

$ aws sts assume-role … | aws-console -

---

Open the generated URL using the default browser:

$ aws-console --browser

Or copy the URL to the system clipboard:

$ aws-console --clipboard

---

Display the generated URL in the terminal as a QR code:

$ aws-console --qr

Or save it as an image to a file:

$ aws-console --qr > qr.png

---

Limit session duration to half an hour:

$ aws-console --duration 30m

Redirect to the IAM service after logging in:

$ aws-console --location iam

---

Federate the user and use the name "audit":

$ aws-console --name audit

Attach a readonly policy to the federated user:

$ aws-console --policy readonly

License

This code is distributed under the MIT License, see LICENSE.txt for more information.

Created by Josh Komoroske ☕