Support for authentication with IAM Identity Center Application

[eggplants]

Describe the feature

aws configure sso / aws sso login provide functionality to obtain a session using IAM Identity Center authentication.

However, these commands do not support authentication using IAM Identity Center applications such as “External AWS accounts.”

Use Case

Like aws sso login, it would be convenient if authentication could be performed “easily” without saml2aws or aws sts assume-role-with-saml using SAMLResponse after browser authentication.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CLI version used

aws-cli/2.27.63 Python/3.13.5 Darwin/24.5.0 source/arm64

Environment details (OS name and version, etc.)

macOS 15.5 (24F74)

[adev-code]

Hello @eggplants, thanks for reaching out. I will present this to the team if the feature request is possible and I will update you as soon as there are updates.

[adev-code]

Hi @eggplants, the team considers about this feature request. For more insights, could you please provide more details on how would you like this to work and how you would like us to do it. This issue will be left open for tracking. Thanks.

[eggplants]

how would you like this to work and how you would like us to do it

As explained in #5061, one possible method would be to launch an automated browser, perform SAML login, and pass the response to AssumeRoleWithSAML for authentication. However, this is exactly what saml2aws does.

With this method, running the automated browser requires drivers and browser binaries, and aws-cli requires a desktop environment to accept user input.

That said, if authentication is possible without an automated browser, that would be ideal, but even looking at the "External AWS accounts" app alone, it seems difficult to determine which IdP it uses and prepare processing tailored to each service.