Small bash script wrapper around aws-google-auth to provide easy (but overridable) defaults.

aws-google-login.sh

unset AWS_PROFILE

google_sso_idp=''
google_sso_sp=''
profile='default'
region='us-east-1'

# Put code into a function so that we can quick escape without using 'exit 1' considering
# if this code gets sourced into bash (which it should for proper usage) using 'exit 1' will kill the process.
function fn_aws_google_login() {
  while test $# -gt 0; do
    case "$1" in
      -h|--help)
        echo "aws-login - Setup auth for aws"
        echo " "
        echo "aws-login [options]"
        echo " "
        echo "Options:               Default       Description"
        echo "-h, --help                           Shows brief help"
        echo "-R, --region=REGION    [us-east-1]   AWS Region which to log into."
        echo "-p, --profile=PROFILE  [default]     The AWS local profile which to store credentials in"
        return 0
        ;;
      -R|--region)
        flag=$1
        shift
        if test $# -gt 0; then
          export region=$1
        else
          echo "The $flag flag requires a region to be provided with it."
          return 1
        fi
        shift
        ;;
      -p|--profile)
        flag=$1
        shift
        if test $# -gt 0; then
          export profile=$1
        else
          echo "The $flag flag requires a that profile be specified."
          return 1
        fi
        shift
        ;;
      *)
        echo "Unrecognized flag $1"
        return 1
        break
        ;;
    esac
  done
  
  aws-google-auth -I $google_sso_idp -S $google_sso_sp -a --resolve-aliases --region $region --profile $profile
  
  # Save the desired profile for this instance of bash
  export AWS_PROFILE=$profile
  
  # Ensure that the bashrc file exists
  touch ~/.bashrc
  
  envVarRegex="(export|EXPORT) AWS_PROFILE=.*"
  newEnvVar="export AWS_PROFILE=$profile"
  
  # If the AWS_PROFILE env variable already exists, replace it.
  # If it doesnt, add it to the .bashrc file for future bash shell invocations.
  if grep -Exq "$envVarRegex" ~/.bashrc; then
    sed -Ei "s/$envVarRegex/$newEnvVar/" ~/.bashrc
  else
    echo $newEnvVar >> ~/.bashrc
  fi
}

# Run the function
fn_aws_google_login $*

Installation

1. Download the aws-google-login.sh file to a known location on your PC. For the sake of simplicity, I will be storing it in ~/.scripts/
2. Setup the google_sso_idp and google_sso_sp variables in the file.
3. Ensure that the file is executable via chmod (chmod 755 ~/.scripts/aws-google-login.sh)
4. (Optional, see 'Recommended Steps') Ensure that the location which you downloaded the script to is available on your PATH

Recommended Steps

When the script executes, it will update the ~/.bashrc file's AWS_PROFILE export variable to specify the aws creds profile that the STS credentials were saved into. This variable is important as the CLI/SDKs will look at this variable to determine which credentials to use (if you're using default, this doesn't matter as much).
Modifying the ~/.bashrc file means that new bash invocations will have the environment variable, however, if you ran the script via just running aws-google-login this variable is not setup in the current bash environment.

As such, it is recommended that you setup the following alias in your ~/.bashrc file to ensure that the variable also gets exported to your current environment.

alias aws-login=". ~/.scripts/aws-google-login.sh"

Then you can execute via: aws-login