*** This version of Confluence is for testing only and contains a copy of content from June 29th 2026. No changes will be preserved. ***
| Warning |
|---|
Update: Upcoming changes to Duo will break this pathway. We strongly urge Cornell AWS CLI users to switch to AWS SSO roles (e.g., sso-admin). Send a note to cloud-support@cornell.edu to get started down that path. |
| Table of Contents |
|---|
...
Use Case
...
| Note |
|---|
The options for "Factor" are "push", "sms", "phone", "auto" |
Advanced Use
| Code Block |
|---|
$ aws --profile foo login configure
ECP Endpoint URL [None]: https://shibidp.cit.cornell.edu/idp/profile/SAML2/SOAP/ECP
Username [None]: pea1
Enable Keyring [False]:
Duo Factor [None]: auto
Role ARN [None]: arn:aws:iam::111111111111:role/shib-admin
$ aws --profile bar login configure
ECP Endpoint URL [None]: https://shibidp.cit.cornell.edu/idp/profile/SAML2/SOAP/ECP
Username [None]: pea1
Enable Keyring [False]:
Duo Factor [None]: auto
Role ARN [None]: arn:aws:iam::222222222222:role/shib-admin
$ aws --profile foo login
Password: **************
# Provided second factor out of band
$ aws --profile foo sts get-caller-identity
{
"Arn": "arn:aws:sts::111111111111:assumed-role/shib-admin/pea1@cornell.edu",
"Account": "111111111111",
"UserId": "XXXXICCPMY7VALLFXXXX:pea1@cornell.edu"
}
$ aws --profile bar login
Password: **************
# Provided second factor out of band
$ aws --profile bar sts get-caller-identity
{
"Arn": "arn:aws:sts::222222222222:assumed-role/shib-admin/pea1@cornell.edu",
"Account": "222222222222",
"UserId": "YYYYICCPMY7VALLFYYYY:pea1@cornell.edu"
}
|
...