{"id":77157,"date":"2023-06-05T13:12:11","date_gmt":"2023-06-05T17:12:11","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=77157"},"modified":"2023-06-05T13:12:11","modified_gmt":"2023-06-05T17:12:11","slug":"use-aws-cli-with-jumpcloud","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud","title":{"rendered":"Use AWS CLI with JumpCloud"},"content":{"rendered":"\n<p>AWS Command Line Interface (AWS CLI) is a powerful open source tool that enables AWS users to interact with AWS services using the command-line.&nbsp;AWS CLI allows users to implement the same functionality available in the AWS Management console using automated scripts and commands.&nbsp;<\/p>\n\n\n\n<p><br>Configuring and using AWS CLI became more streamlined for organizations who are using the AWS IAM Identity Center (successor to AWS SSO) service and AWS CLI v2.&nbsp;With the release of AWS CLI v2, AWS CLI profiles can be linked to AWS IAM Identity Center accounts.&nbsp;Using the JumpCloud integration with AWS IAM Identity Center, users can securely log in to AWS CLI with their JumpCloud account and JumpCloud Multi-Factor Authentication (MFA).<\/p>\n\n\n\n<p><a><\/a><strong>How it works<\/strong><\/p>\n\n\n\n<ol>\n<li>Trigger an AWS SSO login from AWS CLI using a named profile.<\/li>\n\n\n\n<li>Log in with your JumpCloud credentials and MFA in your default browser.<\/li>\n\n\n\n<li>Run your CLI commands using your named profile.<\/li>\n<\/ol>\n\n\n\n<p><strong>Considerations<\/strong><\/p>\n\n\n\n<ul>\n<li>This functionality is only available with AWS CLI v2 or higher.<\/li>\n\n\n\n<li>JumpCloud must be configured as the external identity provider for the AWS IAM Identity Center service.<\/li>\n\n\n\n<li>SAML 2.0 must be the Authentication method.<\/li>\n\n\n\n<li>We recommend using SCIM provisioning to provision\/deprovision users and manage groups and group membership.<\/li>\n<\/ul>\n\n\n\n<h1 class=\"wp-block-heading\"><a><\/a><strong>Configuring AWS CLI to use JumpCloud for SSO<\/strong><\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">Configure JumpCloud integration with AWS IAM Identity Center<\/h3>\n\n\n\n<ol>\n<li>Configure the JumpCloud SSO integration with the AWS IAM Identity Center&nbsp;service.<\/li>\n\n\n\n<li>Optionally, configure the JumpCloud Identity Management integration with AWS IAM Identity Center to create, manage, and remove users and groups to simplify role, permission, and policy application.<\/li>\n\n\n\n<li><a href=\"https:\/\/jumpcloud.com\/support\/authorize-users-to-an-sso-app\" target=\"_blank\" rel=\"noreferrer noopener\">Associate user groups<\/a>&nbsp;to the configured AWS IAM Identity Center integration in JumpCloud.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\"> Assign permissions and policies within each AWS account in AWS IAM Identity Center<\/h3>\n\n\n\n<ol>\n<li class=\"alpha-list\">Login to the AWS management console as an admin.<\/li>\n\n\n\n<li class=\"alpha-list\">Create new permissions under an account (if applicable):\n<ul>\n<li>Navigate to <strong>AWS IAM Identity Center <\/strong>&gt;<strong> AWS accounts <\/strong>&gt;<strong> Permission sets.<\/strong><\/li>\n\n\n\n<li class=\"alpha-list\">Click <strong>Create permission set<\/strong> or click an existing permission set to update it.<\/li>\n\n\n\n<li>These permission automatically get created as roles in AWS IAM and are available for all your AWS organizations.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Navigate to <strong>AWS IAM Identity Center <\/strong>&gt;<strong> AWS accounts <\/strong>&gt;<strong> AWS organization.<\/strong><\/li>\n\n\n\n<li>Select the account.<\/li>\n\n\n\n<li>Click <strong>Assign users<\/strong> option or click an user or group set to add permission sets.<\/li>\n\n\n\n<li>Click <strong>Groups<\/strong> tab to assign permission sets\/roles at the group level or <strong>Users<\/strong> to assign them at the user level.<\/li>\n\n\n\n<li>Check the box next to the group(s) to which you want to add permission.<\/li>\n\n\n\n<li>Click <strong>Next: Permission sets.<\/strong><\/li>\n\n\n\n<li>Select the or unselect the permission sets or <strong>Create new permission set<\/strong> and save changes.<\/li>\n\n\n\n<li>Repeat the steps as needed.<\/li>\n\n\n\n<li>Users associated with the group(s) will inherit the permission set(s) assigned to the group(s) unless excluded by an <strong>Account Based Access Control (ABAC)<\/strong> policy.<\/li>\n\n\n\n<li>Navigate to Settings <strong>AWS IAM Identity Center &gt; Settings.<\/strong><\/li>\n\n\n\n<li>Note your <strong>User portal URL<\/strong>, because you will need it when logging in to AWS CLI.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Create an AWS CLI named profile to use your JumpCloud account and JumpCloud MFA<\/h3>\n\n\n\n<ol>\n<li>Launch AWS CLI.<\/li>\n\n\n\n<li>Trigger an AWS IAM Identity Center login by running the following command:&nbsp;<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>$ aws configure sso<\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"3\">\n<li>Enter your&nbsp; <strong>AWS IAM Identity Center User portal URL<\/strong> at the SSO start URL prompt:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>SSO start URL [None]: [None]: https:\/\/&lt;subdomain&gt;.awsapps.com\/start<\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"4\">\n<li>Enter your AWS IAM Identity Center region:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>SSO region [None]:<strong>us-east-1<\/strong><\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"5\">\n<li>Your default browser will be launched.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><p><strong>Note:<\/strong> If AWS CLI is unable to launch a browser, instructions will appear on how to initiate the SSO login process manually.<\/p><\/div><\/div><\/div>\n\n\n\n<ol start=\"6\">\n<li>Enter your JumpCloud credentials.<\/li>\n\n\n\n<li>Enter your JumpCloud MFA.<\/li>\n\n\n\n<li>Select your account.<\/li>\n\n\n\n<li>Select the role you want to use for that account.<\/li>\n\n\n\n<li>A confirmation of your role selection will appear.<\/li>\n\n\n\n<li>Enter your default region:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>CLI default client Region [None]: <strong>us-east-1<\/strong>&lt;ENTER&gt;<\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"12\">\n<li>Enter your default output format:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>CLI default output format [None]: <strong>json<\/strong>&lt;ENTER&gt;<\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"13\">\n<li>Give your profile a name which will be profile name used to sign in and get temporary credentials:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>CLI profile name [123456789011_ReadOnly]: <strong>999999_S3Admin<\/strong>&lt;ENTER&gt;<\/p>\n<\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Retrieve and cache temporary AWS credentials using your named profile<\/h3>\n\n\n\n<div class=\"wp-block-cgb-notification-card notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><p><strong>Note:<\/strong> Use the named profile you created above to retrieve and cache a set of temporary credentials.<\/p><\/div><\/div><\/div>\n\n\n\n<ol>\n<li>Run the following command:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>$ aws configure sso &#8211;profile <strong>999999_S3Admin<\/strong><\/p>\n<\/div><\/div>\n\n\n\n<ol start=\"2\">\n<li>Your default browser will be launched.<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-notification-card notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><p><strong>Note:<\/strong> If AWS CLI is unable to launch a browser, instructions will appear on how to initiate the SSO login process manually.<\/p><\/div><\/div><\/div>\n\n\n\n<ol start=\"3\">\n<li>Enter your JumpCloud credentials.<\/li>\n\n\n\n<li>Enter your JumpCloud MFA.<\/li>\n\n\n\n<li>You&nbsp; will receive a sign-in confirmation message.<\/li>\n\n\n\n<li>AWS temporary credentials are retrieved for the IAM role specified in the named profile and are cached with an expiration timestamp.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Running AWS CLI commands using your named profile temporary credentials<\/h3>\n\n\n\n<ol>\n<li>Use your cached temporary credentials and your named profile to perform CLI commands:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>$ aws s3 ls &#8211;profile 999999_S3Admin<\/p>\n<\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Sign out and delete cached and temporary credentials<\/h3>\n\n\n\n<ol>\n<li>Run the following command to sign out and delete all cached SSO credentials and all AWS temporary credentials associated with your JumpCloud AWS IAM Identity Center credentials:<\/li>\n<\/ol>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p>$ aws sso logout<\/p>\n<\/div><\/div>\n\n\n\n<h1 class=\"wp-block-heading\"><a><\/a><strong>Learn more<\/strong><\/h1>\n\n\n\n<ul>\n<li><a target=\"_blank\" href=\"https:\/\/support.jumpcloud.com\/support\/s\/article\/Single-Sign-On-SSO-With-AWS-SSO\" rel=\"noreferrer noopener\">Setting up JumpCloud Single Sign-on integration with the AWS IAM Identity Center service<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/support.jumpcloud.com\/support\/s\/article\/Identity-Management-with-AWS-SSO\" target=\"_blank\" rel=\"noreferrer noopener\">Setting up JumpCloud Identity Management for user provisioning with AWS IAM Identity Center service<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>AWS Command Line Interface (AWS CLI) is a powerful open source tool that enables AWS users to interact with AWS [&hellip;]<\/p>\n","protected":false},"author":206,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2855,2856],"support_tag":[],"coauthors":[2842],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Use AWS CLI with JumpCloud - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn how to use AWS CLI with JumpCloud.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Use AWS CLI with JumpCloud\" \/>\n<meta property=\"og:description\" content=\"Learn how to use AWS CLI with JumpCloud.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"890\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"pamkellman\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud\",\"url\":\"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud\",\"name\":\"Use AWS CLI with JumpCloud - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"datePublished\":\"2023-06-05T17:12:11+00:00\",\"dateModified\":\"2023-06-05T17:12:11+00:00\",\"description\":\"Learn how to use AWS CLI with JumpCloud.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Use AWS CLI with JumpCloud\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Use AWS CLI with JumpCloud - JumpCloud","description":"Learn how to use AWS CLI with JumpCloud.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud","og_locale":"en_US","og_type":"article","og_title":"Use AWS CLI with JumpCloud","og_description":"Learn how to use AWS CLI with JumpCloud.","og_url":"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud","og_site_name":"JumpCloud","og_image":[{"width":890,"height":525,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes","Written by":"pamkellman"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud","url":"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud","name":"Use AWS CLI with JumpCloud - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"datePublished":"2023-06-05T17:12:11+00:00","dateModified":"2023-06-05T17:12:11+00:00","description":"Learn how to use AWS CLI with JumpCloud.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/use-aws-cli-with-jumpcloud#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Use AWS CLI with JumpCloud"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/77157"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/206"}],"version-history":[{"count":3,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/77157\/revisions"}],"predecessor-version":[{"id":79431,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/77157\/revisions\/79431"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=77157"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=77157"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=77157"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=77157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}