otty / apps
All apps/AWS SSO CLI

AWS SSO CLI

aws-sso-cli

Securely manage AWS API credentials using AWS SSO

Runs as aws-sso|macOS, Linux, Windows|synfinatic.github.io
Open form in Otty otty.toml

Command form

ai-draft · 7 tasks · 27 fields

Log in to IAM Identity Center, run commands or open the console with a role's credentials, and list roles. Process, ECS, setup and cache commands are left out.

Opens the form; the finished command lands at your prompt, unrun
Run in Otty
otty gui aws-sso-cli
AWS SSO CLIExample values, fixed in this page — nothing here reaches a terminal
Basic
SSO instance
string
Log level
5 choicesenum
ParametersOnly these flags are editable in the form
SSO instance
Name of a non-default SSO instance.
string
--sso-S
Log level
enum
--level-Lerrorwarninfodebugtrace

aws-sso login

Log in
Log inExample values, fixed in this page — nothing here reaches a terminal
Basic
URL action
string
Force a new session
--force
TasksEach one presets the form for one job
Log in
url_actionforce
ParametersOnly these flags are editable in the form
URL action
How to handle the SSO login URL.
string
--url-action-u
Threads
integer
--threads
Force a new session
Ends the current SSO session and starts a new one.
boolean
--force-f

aws-sso exec

Run a command with a role
Run a command with a roleExample values, fixed in this page — nothing here reaches a terminal
Basic
Profile*
string
Command and arguments
string
TasksEach one presets the form for one job
Shell with a profile
profilecommand
Command with an account and role
accountrolecommand
ParametersOnly these flags are editable in the form
Profile
string
--profile-p
Role ARN
string
--arn-a
Account ID
string
--account-A
Role name
string
--role-R
Do not set default region
boolean
--no-region
Overwrite existing AWS_* variables
boolean
--overwrite-env-O
Refresh STS credentials
boolean
--sts-refresh
Command and arguments
Leave empty to start an interactive shell.
string · positional 0 · repeatable

aws-sso console

Open the AWS console
Open the AWS consoleExample values, fixed in this page — nothing here reaches a terminal
Basic
Profile*
string
Region
string
URL action
string
Advanced
Session duration (minutes)
integer
TasksEach one presets the form for one job
Console for a profile
profileregiondurationurl_action
Console, choose a role interactively
promptregionurl_action
ParametersOnly these flags are editable in the form
Profile
string
--profile-p
Prompt to select a role
boolean
--prompt-P
Account ID
string
--account-A
Role name
Requires an account ID.
string
--role-R
Role ARN
string
--arn-a
Region
string
--region-r
Session duration (minutes)
integer
--duration-d
URL action
What to do with the generated URL.
string
--url-action-u

aws-sso list

List roles
List rolesExample values, fixed in this page — nothing here reaches a terminal
Basic
Fields to show
string
Sort by field
string
Reverse sort
--reverse
TasksEach one presets the form for one job
List roles
fieldssortreverse
Export roles as CSV
fieldscsvprefixsort
ParametersOnly these flags are editable in the form
Fields to show
Field names such as AccountIdPad, AccountAlias, RoleName, Expires.
string · positional 0 · repeatable
List available fields
boolean
--list-fields-f
Filter by field prefix
FieldName=Prefix
string
--prefix-P
CSV output
boolean
--csv
Sort by field
string
--sort-s
Reverse sort
boolean
--reverse
SourcesEvery flag above is checked against these
ref
* `--sso <name>`, `-S` -- Specify non-default AWS SSO instance to use (`$AWS_SSO`) * `--level <level>`, `-L` -- Change default log level: [error|warn|info|debug|trace]
manual2026-10-27

github.com

ref
* `--url-action`, `-u` -- How to handle URLs for your SSO provider * `--threads <int>` -- Number of threads to use with AWS (default: 5) * `--force`, `-f` -- End the current SSO session and start a new one, resetting the
manual2026-10-27

github.com

ref
* `--arn <arn>`, `-a` -- ARN of role to assume (`$AWS_SSO_ROLE_ARN`) * `--account <account>`, `-A` -- AWS AccountID of role to assume (`$AWS_SSO_ACCOUNT_ID`) * `--role <role>`, `-R` -- Name of AWS Role to assume (`$AWS_SSO_ROLE_NAME`) * `--profile <profile>`, `-p` -- Name of AWS Profile to assume * `--no-region` -- Do not set the [AWS_DEFAULT_REGION](config.…
manual2026-10-27

github.com

ref
* `--duration <minutes>`, `-d` -- AWS Session duration in minutes (default 60) * `--prompt`, `-P` -- Force interactive prompt to select role * `--region <region>`, `-r` -- Specify the `$AWS_DEFAULT_REGION` to use * `--arn <arn>`, `-a` -- ARN of role to assume (`$AWS_SSO_ROLE_ARN`) * `--account <account>`, `-A` -- AWS AccountID of role to assume (`$AWS_SSO_AC…
manual2026-10-27

github.com

ref
* `--list-fields`, `-f` -- List the available fields to print * `--prefix <FieldName>=<Prefix>`, `-P` -- Filter results by the given field * `--csv` -- Generate results in CSV format * `--sort <FieldName>`, `-s` -- Sort results by the provided field name * `--reverse` -- Reverse the sort order Arguments: `[<field> ...]`
manual2026-10-27

github.com

Before it fills your prompt, Otty checks the installed aws-sso against its version. A form that does not match your version is not offered.