aws-sso-creds

aws-sso-creds.md

aws-sso-creds

Logs in via AWS SSO and writes temporary credentials to ~/.aws/credentials so tools like NoSQL Workbench can use them.

Usage

# Login with default profile
aws-sso-creds

# Login with a specific profile
aws-sso-creds my-profile

What it does

1. Runs aws sso login (opens browser for SSO authentication)
2. Exports the temporary STS credentials (access key, secret key, session token)
3. Writes them to ~/.aws/credentials under the specified profile

Notes

• Credentials expire after ~12 hours — just re-run the script to refresh.
• Requires AWS CLI v2 installed and an SSO session configured in ~/.aws/config.
• NoSQL Workbench will pick up credentials from the profile name in ~/.aws/credentials.

aws-sso-creds.sh

#!/bin/bash
# Logs in via AWS SSO and writes temporary credentials to ~/.aws/credentials
# so tools like NoSQL Workbench can pick them up.

PROFILE="${1:-default}"

echo "🔐 Logging in via SSO (profile: $PROFILE)..."
aws sso login --profile "$PROFILE"

if [ $? -ne 0 ]; then
  echo "❌ SSO login failed."
  exit 1
fi

echo "📦 Fetching temporary credentials..."
CREDS=$(aws configure export-credentials --profile "$PROFILE" --format env 2>&1)

if [ $? -ne 0 ]; then
  echo "❌ Failed to export credentials: $CREDS"
  exit 1
fi

AWS_ACCESS_KEY_ID=$(echo "$CREDS" | grep AWS_ACCESS_KEY_ID | cut -d= -f2)
AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | grep AWS_SECRET_ACCESS_KEY | cut -d= -f2)
AWS_SESSION_TOKEN=$(echo "$CREDS" | grep AWS_SESSION_TOKEN | cut -d= -f2)
AWS_CREDENTIAL_EXPIRATION=$(echo "$CREDS" | grep AWS_CREDENTIAL_EXPIRATION | cut -d= -f2)

if [ -z "$AWS_ACCESS_KEY_ID" ]; then
  echo "❌ Could not parse credentials."
  exit 1
fi

CREDS_FILE=~/.aws/credentials

# Write credentials to the profile section in ~/.aws/credentials
# Remove existing section if present, then append
if [ -f "$CREDS_FILE" ]; then
  # Remove existing block for this profile
  sed -i '' "/^\[$PROFILE\]/,/^\[/{ /^\[.*\]/!d; /^\[$PROFILE\]/d; }" "$CREDS_FILE" 2>/dev/null
  # Clean up empty lines at end
  sed -i '' -e :a -e '/^\n*$/{$d;N;ba' -e '}' "$CREDS_FILE" 2>/dev/null
fi

cat >> "$CREDS_FILE" <<EOF

[$PROFILE]
aws_access_key_id = $AWS_ACCESS_KEY_ID
aws_secret_access_key = $AWS_SECRET_ACCESS_KEY
aws_session_token = $AWS_SESSION_TOKEN
EOF

echo ""
echo "✅ Credentials written to $CREDS_FILE [$PROFILE]"
echo "⏰ Expires: $AWS_CREDENTIAL_EXPIRATION"
echo ""
echo "NoSQL Workbench should now be able to connect using profile: $PROFILE"