AWS SSO

Execute shell command on EC2 instance via SSM using AWS SSO credentials.

No SSH access or inbound ports required. Uses SSM's RunShellScript document.

Prerequisites:

• MUST first authenticate using aws_sso_login
• EC2 instance MUST have SSM Agent installed
• Instance needs IAM role with AmazonSSMManagedInstanceCore policy
• Your role needs ssm:SendCommand and ssm:GetCommandInvocation permissions

Required: instanceId, accountId, roleName, command Optional: region

Returns: Execution context, command output, errors, troubleshooting guidance

Execute AWS CLI command using temporary credentials from AWS SSO.

Workflow:

1. Verifies valid AWS SSO authentication token
2. Obtains temporary credentials for account and role
3. Executes the AWS CLI command
4. Caches credentials for future use (1 hour)

Prerequisites:

• MUST first authenticate using aws_sso_login
• AWS CLI MUST be installed on the system
• AWS SSO must be configured

Required: accountId, roleName, command Optional: region

Returns: Execution context, command output, errors, exit code

Initiate AWS SSO device authorization flow to obtain temporary credentials.

This flow works as follows:

1. Generates a unique user verification code and authentication URL
2. Opens a browser to AWS SSO login page (if launchBrowser: true)
3. You enter the verification code and complete AWS SSO login
4. Background polling automatically collects and caches the token
5. The cached token is used by other AWS SSO tools

IMPORTANT FOR AI ASSISTANTS: When the tool returns authentication instructions:

• ALWAYS check if a browser window opened automatically
• If browser opened: Guide the user to complete authentication
• If no browser opened: Instruct user to manually open the URL and enter code
• Always provide both the verification code and URL as backup

Prerequisites:

• AWS SSO must be configured with a start URL and region
• Browser access is required for authentication
• You must have an AWS SSO account with appropriate permissions

Returns: Authentication status, session details, verification code and URL

List all AWS accounts and roles accessible through AWS SSO.

Provides essential information needed for aws_sso_exec_command:

• Fetches all accessible accounts with IDs, names, and emails
• Retrieves all available roles for each account
• Handles pagination internally
• Caches account and role information

Prerequisites:

• MUST first authenticate using aws_sso_login
• AWS SSO must be configured with a start URL and region

Returns: Account list with IDs, names, roles, and session status

Check current AWS SSO authentication status.

Verifies if a valid cached token exists and its expiration time. Does NOT perform authentication - only checks status. If no valid token exists, instructs you to run aws_sso_login.

Use before calling aws_sso_ls_accounts or aws_sso_exec_command.

Returns: Authentication status, session details, expiration time, next steps