# Access to AWS

AWS IAM Identity Center (formerly AWS Single Sign-On) manages access to your AWS accounts. This guide helps you set up browser-based and command-line access to AWS.

## Things to consider

<!-- prettier-ignore-start -->
!!! tip "Recommended practice"
    Use the role with the least privileges needed for your task. If you're just browsing the AWS Console, a read-only role is likely enough. This prevents accidental changes and follows the principle of least privilege.
<!-- prettier-ignore-end -->

## Before you begin

Make sure you have [ok](../set-up-your-machine/ok.md) and the [AWS CLI](../set-up-your-machine/aws-cli.md) installed, and that your Microsoft account has been granted access to one or more AWS accounts. Contact Team Utviklerflyt if you need help with any of this.

## Step 1: Verify browser-based access

Access the AWS web interface ("AWS Console") by following these steps:

1. Visit [https://osloorigo.awsapps.com/start](https://osloorigo.awsapps.com/start)
1. Sign in using your Microsoft account
1. Verify that you have access to one more AWS accounts

## Step 2: Configure command-line access

The AWS CLI reads settings from _profiles_ in an `$HOME/.aws/config` file. Each profile tells the CLI which AWS account and role to use, and includes settings like your default region and how to authenticate.

<!-- prettier-ignore-start -->
!!! tip "AWS CLI Profile"
    A profile is a named set of settings that tells the AWS CLI how to access AWS resources. You can have many profiles
    on your computer, each representing access to a different AWS account or role. For example, you might have one profile
    for admin access to your development account, and another for read-only access to production.
<!-- prettier-ignore-end -->

You can define these profiles manually, but it gets tedious when you have many accounts and roles. The [ok](../set-up-your-machine/ok.md) command generates profiles automatically with consistent naming:

1. Install the [AWS CLI](../set-up-your-machine/aws-cli.md) if you haven't already.
1. Generate AWS CLI configuration by running the following command - your default web browser opens automatically and asks for access as part of the process:

   ```sh
   ok aws generate \
     --sso-start-url "https://osloorigo.awsapps.com/start" \
     --sso-region "eu-west-1" \
     --template 'ok-{{.AccountName}}-{{if eq .RoleName "AWSAdministratorAccess"}}admin{{else if eq .RoleName "OrigoReadOnlyAccess"}}read{{else}}{{.RoleName}}{{end}}'
   ```

1. Copy the content between the two `---` markers in the command output into your `$HOME/.aws/config` file. Create the file if it doesn't already exist.
1. Run `aws sso login --sso-session origo` to get a valid SSO access token.
1. Run `aws --profile "<profile-name>" sts get-caller-identity` to check that you're able to assume a specific IAM role in a specific account, replacing `<profile-name>` with one of the profiles in your AWS CLI configuration file.

After this setup, you'll have a profile for each AWS account and role combination. Use these profiles with the AWS CLI by setting the `AWS_PROFILE` environment variable or using the `--profile` flag. The shell snippets below make it easier to switch profiles.

## Step 3: Improve the command-line experience (optional)

Consider adding these small functions to your `$HOME/.bashrc` or `$HOME/.zshrc`:

1. Add a shell function `sso` that switches between AWS CLI profiles on the command-line:

   ```sh
   function sso() {
     local profile="$(aws configure list-profiles | fzf)"
     export AWS_PROFILE="$profile"
     aws sso login
   }
   ```

1. Add a shell function `sso-browser` that opens the AWS Console in your browser for a selected AWS CLI profile:

   ```sh
   function sso-browser() {
     local sso_start_url sso_role_name sso_account_id url
     local profile=$(aws configure list-profiles | fzf)
     sso_start_url="https://osloorigo.awsapps.com/start"
     sso_role_name="$(aws configure --profile "$profile" get "sso_role_name")"
     sso_account_id="$(aws configure --profile "$profile" get "sso_account_id")"
     url="$sso_start_url/#/console?account_id=$sso_account_id&role_name=$sso_role_name"
     if command -v xdg-open >/dev/null 2>&1; then
       xdg-open "$url"
     elif command -v open >/dev/null 2>&1; then
       open "$url"
     else
       echo "Failed to open default web browser" >&2
       echo "Visit the following URL to log in: $url"
     fi
   }
   ```

1. Add a snippet to your shell configuration file that gives you a nice-looking prompt that displays the active AWS profile (if any) in your prompt:

   ```sh
   if [ "$ZSH_NAME" != "" ]; then
     setopt PROMPT_SUBST
     PROMPT='🚀 %B%F{%(?.blue.red)}%1~%f%b${AWS_PROFILE:+" (🔓 $AWS_PROFILE)"}%F{default} '
   elif [ "$BASH" != "" ]; then
     PS1='\[\033[01;34m\]🚀 \W\[\033[00m\]${AWS_PROFILE:+\[\033[33m\] (🔓 $AWS_PROFILE)\[\033[00m\]} '
   fi
   ```

Questions or issues? Reach out in [`#utviklerflyt-support`](https://oslokommune.slack.com/archives/CV9EGL9UG) on Slack.