saml2aws

A command-line tool that converts SAML assertions into AWS credentials.

Runs as saml2aws|macOS, Linux, Windows|github.com

Command form

ai-draft · 4 tasks · 13 fields

Log in to a SAML identity provider for temporary AWS credentials, or run a command with them. Provider-specific login flags (Okta, OneLogin, F5 APM) are left out.

Opens the form; the finished command lands at your prompt, unrun

Run in Otty

otty gui saml2aws

`saml2aws login`

Basic

IDP account

string

AWS profile

string

Role ARN

string

Force refresh

--force

Advanced

Session duration (seconds)

integer

TasksEach one presets the form for one job

idp_accountprofilerolesession_durationforce

Force a refresh

idp_accountprofileforceskip_prompt

ParametersOnly these flags are editable in the form

IDP account

string

--idp-account-a

AWS profile

Profile that receives the temporary credentials.
string

--profile-p

Role ARN

string

--role

Session duration (seconds)

integer

--session-duration

Force refresh

Refresh credentials even if not expired.
boolean

--force

Skip prompts

boolean

--skip-prompt

Skip certificate verification

boolean

--skip-verify-s

`saml2aws exec`

Run a command with credentials

Exec the supplied command with env vars from STS token.

Run a command with credentialsExample values, fixed in this page — nothing here reaches a terminal

Basic

AWS profile

string

Execution profile

string

Command*

string

TasksEach one presets the form for one job

Run a command

profileexec_profilecommand

ParametersOnly these flags are editable in the form

AWS profile

string

--profile-p

Execution profile

Profile used for command execution, e.g. for secondary role assumption.
string

--exec-profile

Command

string · positional 0 · repeatable

`saml2aws console`

Open the AWS console

Console will open the aws console after logging in.

Open the AWS consoleExample values, fixed in this page — nothing here reaches a terminal

Basic

AWS profile

string

Force refresh

--force

Print link only

--link

TasksEach one presets the form for one job

Open console

profileforcelink

ParametersOnly these flags are editable in the form

AWS profile

string

--profile-p

Force refresh

boolean

--force

Print link only

Present a link instead of opening the browser.
boolean

--link

SourcesEvery flag above is checked against these

help

-a, --idp-account="default" The name of the configured IDP account. (env: SAML2AWS_IDP_ACCOUNT) -s, --skip-verify Skip verification of server certificate. (env: SAML2AWS_SKIP_VERIFY) --skip-prompt Skip prompting for parameters during login. --session-duration=SESSION-DURATION --role=ROLE The ARN of th…

help2026-10-27

github.com

help

exec [<flags>] [<command>...] Exec the supplied command with env vars from STS token. -p, --profile=PROFILE The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE) --exec-profile=EXEC-PROFILE

help2026-10-27

github.com

help

console [<flags>] Console will open the aws console after logging in. -p, --profile=PROFILE The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE) --force Refresh credentials even if not expired. --link Present link to AWS console instead of opening browser

help2026-10-27

github.com

Before it fills your prompt, Otty checks the installed saml2aws against its version. A form that does not match your version is not offered.