manage a aws-sso profile in ~/.aws/config

[synfinatic]

The idea here is that rather than setting a bunch of variables in the environment, it may just be easier to manage named profiles in the aws config files. per the docs we can even pass in the AWS_SESSION_TOKEN in the config file and of course the region as well. Seems very similar to #15.

You could then even run aws-sso as a daemon and it can auto-refresh credentials before they expire.

AWS even has support for doing this via external processes: https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#sourcing-credentials-from-external-processes (Fixed in #158)

Depends on #212

[synfinatic]

So the question is basically, should the user have:

1. One profile for all AWS SSO Roles (means you can't have different roles in different terminal sessions)
2. Multiple profiles and some how map a role to a profile
3. 1:1 mapping of profiles and roles

Only the 3rd option seems useful? Basically turns into a question can we edit the ~/.aws/config file and add/delete profiles when the role becomes (un)available?

As of AWS CLI v2, it honors AWS_CONFIG_FILE=/path/to/config_file so that's an option too?

[synfinatic]

what about just using a template marker like terraform-docs does? aka:

<!-- BEGIN_TF_DOCS -->
{{ .Content }}
<!-- END_TF_DOCS -->

and generate a series of entries like:

[profile <name>]
credential_process = /usr/local/bin/aws-sso process --sso <name> --arn <arn>

then users can just use the typical AWS_PROFILE environment variable for AWS SSO just like more traditional static API keys. This becomes a really consistent user experience.

[synfinatic]

also should support output=json or other output values