*** This version of Confluence is for testing only and contains a copy of content from June 29th 2026. No changes will be preserved. ***
| Warning |
|---|
Update: Upcoming changes to Duo will break this pathway. We strongly urge Cornell AWS CLI users to switch to AWS SSO roles (e.g., sso-admin). Send a note to cloud-support@cornell.edu to get started down that path. |
| Table of Contents |
|---|
...
Use Case
| Excerpt |
|---|
This document shows how to setup and use the awscli-login tool to retrieve temporary AWS access keys using your Cornell netid credentials and Duo (i.e., Cornell Two-Step Login). Using temporary access keys associated with an AWS role to authenticate to the AWS Command Line Interface (CLI) is much safer than using fixed AWS access keys tied to an IAM user. Now that this option is available to Cornell AWS users, we recommend that fixed access keys no longer be used for humans using the AWS CLI. |
Prerequisites
| Warning |
|---|
The awscli-login tool does NOT work with AWS CLI version 2.x, however, AWS SSO does and is available now! Check out our docs and send us a ticket to request access to AWS SSO. |
| Info |
|---|
We are told that awscli-login now works with Windows, though we don't yet have any Windows-specific instructions here. Let us know if you can provide some! |
...
| Note |
|---|
The options for "Factor" are "push", "sms", "phone", "auto" |
Advanced Use
| Code Block |
|---|
$ aws --profile foo login configure
ECP Endpoint URL [None]: https://shibidp.cit.cornell.edu/idp/profile/SAML2/SOAP/ECP
Username [None]: pea1
Enable Keyring [False]:
Duo Factor [None]: auto
Role ARN [None]: arn:aws:iam::111111111111:role/shib-admin
$ aws --profile bar login configure
ECP Endpoint URL [None]: https://shibidp.cit.cornell.edu/idp/profile/SAML2/SOAP/ECP
Username [None]: pea1
Enable Keyring [False]:
Duo Factor [None]: auto
Role ARN [None]: arn:aws:iam::222222222222:role/shib-admin
$ aws --profile foo login
Password: **************
# Provided second factor out of band
$ aws --profile foo sts get-caller-identity
{
"Arn": "arn:aws:sts::111111111111:assumed-role/shib-admin/pea1@cornell.edu",
"Account": "111111111111",
"UserId": "XXXXICCPMY7VALLFXXXX:pea1@cornell.edu"
}
$ aws --profile bar login
Password: **************
# Provided second factor out of band
$ aws --profile bar sts get-caller-identity
{
"Arn": "arn:aws:sts::222222222222:assumed-role/shib-admin/pea1@cornell.edu",
"Account": "222222222222",
"UserId": "YYYYICCPMY7VALLFYYYY:pea1@cornell.edu"
}
|
...