如何在没有浏览器支持的情况下批准 aws sso 登录

Question

aws sso login --profile //profile name// is usually open browser and ask for approval is there any other way we can do this without browser. I have a situation where I need to setup aws cli in my docker container and I can only use aws sso login and I don't want to use any selenium to handle browser approval since its looks complex so I want to do all in cli itself…

Answer 1

aws sso login takes a --no-browser flag which suppresses the browser launch

From there you can control the sso verification url via a browser automation library eg puppeteer.

You can also get the verification url via aws sso-oidc actions/commands.

An example in golang using go-rod is available on github here although this won't work with a non-mfa process flow, which is what you want here. The code at the link can be modded or updated to support that use-case with not a whole lot of effort.

Generally using aws sso isn't recommedended for this type of use-case . Instead, you're better off using IAM user credentials (while outside VPC for example) or if in a VPC - instance profiles if they're available.

Answer 2

Yes that's a common scenario and AWS has lot of documentation on AWS SSO using CLI. You have to setup AWS SSO Config and after that commands will work with defaults or command line arguments you'll pass.

Reference docs with step by step details

https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html