Hacker News Reader

Comment by RegnisGnaw | Hacker News Reader

That is one convoluted solution. Easier:

Federate users to AWS using SAML https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr...

Or OIDC, if SAML gives one a rash: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr...

The aws-vault project recently added support for AssumeRoleWithWebIdentity making it cheap to issue yourself disposable credentials: https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USA... including launching AWS Console links for those Roles: https://github.com/99designs/aws-vault/blob/v6.0.0-beta9/USA...

Kind of speaking to the blog post's intention, I actually don't have any IAM Users in my AWS account

It is like they created a solution specifically to have a blog post.

Agreed. Rolling your own login solution just to federate access to users seems really, really, unnecessary. There are a million other ways in AWS to accomplish the same task without writing any code, or leaving around a random lambda that will likely be forgotten in a few years.

I’ll be implementing something similar soon, and don’t want to overengineer it. Could you please list the top options and their pros and cons? Thank you in advance!

SAML SSO setup is also one of the singlemost convoluted things most people need to do with AWS, but at least you only have to set it up once (per account).

It’s basically a little mini-nightmare, at least when integrating it into G Suite. Burns a big chunk of a day.

I've found it fairly easy to do on a new account with Okta and Terraform. Was probably a pain the first time (don't remember anymore) but it's been 99% automated after that.

Yeah this was really difficult to wrap my head around and get right the first time (and with an old version of Okta's integration)...and I'm saying that having previously written my own SAML Identity Provider from scratch.

It's a lot easier now though and especially now that I understand how it all works.

Okta is the only solution I've used that gives you the flexibility you need to make SSO not a nightmare. G Suite and Rippling are both very half-baked and integrations are often broken or the granularity you're looking for is not possible (they also both seem to treat SAML as a last resort and would rather push you to custom Oauth or other flows instead, making every integration work a little bit differently).

There may be a few others like One Login where this is their entire business like Okta that are also good, I don't have experience with any others.

G Suite works extremely well with Google Cloud at least.

So much so that we don't bother with Okta there. The Okta logins are the G Suite emails anyway.

Auth0 is also awesome

This is murder to do for the command line. IAM users are the right choice for CLI.

edit: apparently aws sso assists here!

There is some tooling around this that makes it a little less painful, for example with okta i use a tool [0] that i only have to worry about once a day usually, and it's not as painful as okta's own tooling.

However, it does require some understanding, standardization, and general competence from those around you as well.

[0] - https://github.com/jmhale/okta-awscli

I use this thing Nike made. Looks pretty similar.

https://github.com/Nike-Inc/gimme-aws-creds

Is this a significant differentiator with GCP? I log into gcloud with the same identity used by the web console and the rest of Gsuite.

I read the article and wondered why they don’t simply grant object access to a group of users using their existing identity, but I’m not as familiar with AWS as I am with GCP.

For interactive cli use (that is: a person sitting at a computer), SSO is directly supported. `aws sso login ` pops up the web browser, starts the sso login flow and temporary credentials are issued for the cli. Has been working pretty neat for us.

I stand corrected, it seems like! Looks like it rolled out last Nov for the named profiles from the RSS feed.

very happy to see work on this front!!

This doesn't work if you use OneLogin with IDP initiated login (and multiple accounts).

Which sucks. We've had to write our own tooling, and you even need to use an extension like this[1] :(

1. https://chrome.google.com/webstore/detail/saml-to-aws-sts-ke...

We used to use something similar (for office365/AzureAD), but the aws cli Version 2.0 in combination with the changes for aws sso late last year made that obsolete. You may want to check again if your case is now supported. I was pleasantly surprised, even though I had to do the saml setup dance again.

Have you considered saml2aws[0]?

[0] https://github.com/Versent/saml2aws

What if the Idp is not SAML compliant

Reply on news.ycombinator.com