Console login
Sign in with console credentials in the browser, the flow behind `aws login`.
A console login session signs you in to AWS in the browser with the credentials you use for the AWS Management Console: an IAM user, the root user, or IAM federation. It is the flow behind aws login, for accounts that do not use IAM Identity Center. No access key is stored. rolle keeps a refresh token in the OS keychain and renews the short-lived credentials from it for up to 12 hours.
rolle session add aws-login --name console --region us-east-1
rolle start consoleThe first start opens the browser. Approve the sign-in and return to rolle. Later starts reuse the sign-in until it lapses; the next start then opens the browser again.
| Flag | Meaning |
|---|---|
--name |
Session name |
--region |
Region to sign in to, and the default region for tools |
--profile |
AWS profile name. Empty uses default |
Without a browser
On a host without a browser, for example over SSH, run rolle start <session> --no-browser. rolle prints a sign-in URL for the cross-device flow, the one behind aws login --remote. Open the URL on any device, sign in, and paste the code the page shows back into the terminal.
Permissions
An IAM user or role needs the SignInLocalDevelopmentAccess managed policy. The root user needs nothing. An account can restrict each flow in an IAM policy with the arn:aws:signin:{region}:{account}:oauth2/public-client/localhost resource for the same-device flow and .../oauth2/public-client/remote for the cross-device flow.
Console
Open console does not work for a console login. AWS federation accepts role and federation tokens only, and answers “Only federation tokens or assume role tokens may be used for federated login” for these credentials. Add an assume-role session with the console login as its source and open the console from the role.
How it works
The sign-in is an OAuth 2.0 authorization code flow with PKCE against AWS Sign-In. The browser returns to a listener on 127.0.0.1. AWS answers with credentials that last 15 minutes and a refresh token bound to a key pair that rolle generates for the session (DPoP). rolle renews the credentials in the background while the refresh token works. The refresh token and the private key live in the OS keychain and go when you remove the session.
The session learns its account on the first sign-in and shows it under its name.