ssof 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- ssof-0.1.0/PKG-INFO +232 -0
- ssof-0.1.0/README.md +217 -0
- ssof-0.1.0/pyproject.toml +26 -0
- ssof-0.1.0/setup.cfg +4 -0
- ssof-0.1.0/ssof.egg-info/PKG-INFO +232 -0
- ssof-0.1.0/ssof.egg-info/SOURCES.txt +10 -0
- ssof-0.1.0/ssof.egg-info/dependency_links.txt +1 -0
- ssof-0.1.0/ssof.egg-info/entry_points.txt +2 -0
- ssof-0.1.0/ssof.egg-info/requires.txt +7 -0
- ssof-0.1.0/ssof.egg-info/top_level.txt +1 -0
- ssof-0.1.0/tori/cli.py +215 -0
- ssof-0.1.0/tori/sso_manager.py +869 -0
ssof-0.1.0/PKG-INFO
ADDED
|
@@ -0,0 +1,232 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: ssof
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: A simple CLI tool to manage AWS SSO sessions
|
|
5
|
+
Author-email: Your Name <your.email@example.com>
|
|
6
|
+
License: MIT
|
|
7
|
+
Requires-Python: >=3.10
|
|
8
|
+
Description-Content-Type: text/markdown
|
|
9
|
+
Requires-Dist: click>=8.3.0
|
|
10
|
+
Requires-Dist: boto3>=1.43.0
|
|
11
|
+
Requires-Dist: questionary>=2.1.0
|
|
12
|
+
Provides-Extra: dev
|
|
13
|
+
Requires-Dist: pytest>=9.0.0; extra == "dev"
|
|
14
|
+
Requires-Dist: black>=26.0.0; extra == "dev"
|
|
15
|
+
|
|
16
|
+
# Tori - AWS SSO Session Manager
|
|
17
|
+
|
|
18
|
+
Ultra-simple CLI tool to manage AWS SSO sessions across multiple organizations. Configure once per org, then just `tori assume <account>` and you're in!
|
|
19
|
+
|
|
20
|
+
## Installation
|
|
21
|
+
|
|
22
|
+
Tori uses [uv](https://docs.astral.sh/uv/) for dependency management.
|
|
23
|
+
|
|
24
|
+
```bash
|
|
25
|
+
# Install uv if you don't have it
|
|
26
|
+
brew install uv # or: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
27
|
+
|
|
28
|
+
# Sync dependencies and install tori in editable mode
|
|
29
|
+
uv sync
|
|
30
|
+
|
|
31
|
+
# Run tori via uv (no activation needed)
|
|
32
|
+
uv run tori --help
|
|
33
|
+
|
|
34
|
+
# Or activate the venv to use `tori` directly
|
|
35
|
+
source .venv/bin/activate
|
|
36
|
+
tori --help
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
## Quick Start
|
|
40
|
+
|
|
41
|
+
1. **Configure Tori with your SSO details**:
|
|
42
|
+
```bash
|
|
43
|
+
tori configure my-org
|
|
44
|
+
```
|
|
45
|
+
Enter your SSO start URL and region when prompted. Tori will authenticate and cache all available accounts.
|
|
46
|
+
|
|
47
|
+
2. **List available accounts**:
|
|
48
|
+
```bash
|
|
49
|
+
tori list
|
|
50
|
+
```
|
|
51
|
+
This shows all AWS accounts you have access to via SSO across all configured orgs.
|
|
52
|
+
|
|
53
|
+
3. **Assume a role**:
|
|
54
|
+
```bash
|
|
55
|
+
tori assume my-account-name
|
|
56
|
+
```
|
|
57
|
+
This will:
|
|
58
|
+
- Authenticate with AWS SSO (if needed)
|
|
59
|
+
- Get temporary credentials
|
|
60
|
+
- Back up your current default profile (if exists) to a named profile
|
|
61
|
+
- Configure your default AWS CLI profile automatically
|
|
62
|
+
- You're ready to use AWS CLI immediately!
|
|
63
|
+
|
|
64
|
+
## Commands
|
|
65
|
+
|
|
66
|
+
### `tori configure <org-name>`
|
|
67
|
+
Configure AWS SSO settings for an organization. You can configure multiple orgs.
|
|
68
|
+
|
|
69
|
+
**Example:**
|
|
70
|
+
```bash
|
|
71
|
+
tori configure my-company
|
|
72
|
+
# Enter SSO start URL: https://my-company.awsapps.com/start
|
|
73
|
+
# Enter SSO region: us-east-1
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
The first org you configure becomes the default. All accounts will be cached automatically.
|
|
77
|
+
|
|
78
|
+
### `tori assume <account> [org-name]`
|
|
79
|
+
Assume an AWS SSO role and configure the default AWS profile with credentials.
|
|
80
|
+
|
|
81
|
+
**Examples:**
|
|
82
|
+
```bash
|
|
83
|
+
# Assume by account name (uses default org)
|
|
84
|
+
tori assume production
|
|
85
|
+
|
|
86
|
+
# Assume by account ID
|
|
87
|
+
tori assume 123456789012
|
|
88
|
+
|
|
89
|
+
# Assume from specific org
|
|
90
|
+
tori assume production my-company
|
|
91
|
+
|
|
92
|
+
# Assume with specific role (skips interactive selection)
|
|
93
|
+
tori assume production my-company --role AdminRole
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
**Profile Backup:** When you assume a new role, Tori automatically backs up your current default profile to `profile_<account_id>_<role_name>` so you can switch back later.
|
|
97
|
+
|
|
98
|
+
### `tori refresh [org-name]`
|
|
99
|
+
Refresh cached accounts for an organization. Use this when new accounts or roles are added.
|
|
100
|
+
|
|
101
|
+
**Examples:**
|
|
102
|
+
```bash
|
|
103
|
+
# Refresh default org
|
|
104
|
+
tori refresh
|
|
105
|
+
|
|
106
|
+
# Refresh specific org
|
|
107
|
+
tori refresh my-company
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
### `tori list [org-name]`
|
|
111
|
+
List all configured orgs and their AWS SSO accounts.
|
|
112
|
+
|
|
113
|
+
**Examples:**
|
|
114
|
+
```bash
|
|
115
|
+
# List all orgs and accounts
|
|
116
|
+
tori list
|
|
117
|
+
|
|
118
|
+
# List accounts for specific org
|
|
119
|
+
tori list my-company
|
|
120
|
+
```
|
|
121
|
+
|
|
122
|
+
### `tori status`
|
|
123
|
+
Check your current AWS credentials status and see all backed up profiles.
|
|
124
|
+
|
|
125
|
+
### `tori default <org-name>`
|
|
126
|
+
Set the default organization to use when org name is not specified.
|
|
127
|
+
|
|
128
|
+
**Example:**
|
|
129
|
+
```bash
|
|
130
|
+
tori default my-company
|
|
131
|
+
```
|
|
132
|
+
|
|
133
|
+
## Configuration
|
|
134
|
+
|
|
135
|
+
Tori stores its configuration in `~/.tori/config.yaml`:
|
|
136
|
+
|
|
137
|
+
```yaml
|
|
138
|
+
default_org: my-company
|
|
139
|
+
orgs:
|
|
140
|
+
my-company:
|
|
141
|
+
sso_start_url: https://my-company.awsapps.com/start
|
|
142
|
+
sso_region: us-east-1
|
|
143
|
+
cached_accounts:
|
|
144
|
+
production:
|
|
145
|
+
accountId: '123456789012'
|
|
146
|
+
accountName: production
|
|
147
|
+
email: aws-prod@company.com
|
|
148
|
+
roles:
|
|
149
|
+
- AdminRole
|
|
150
|
+
- ReadOnlyRole
|
|
151
|
+
another-org:
|
|
152
|
+
sso_start_url: https://another-org.awsapps.com/start
|
|
153
|
+
sso_region: us-west-2
|
|
154
|
+
cached_accounts: {}
|
|
155
|
+
active_profiles:
|
|
156
|
+
profile_123456789012_AdminRole:
|
|
157
|
+
account_id: '123456789012'
|
|
158
|
+
role_name: AdminRole
|
|
159
|
+
timestamp: '2025-11-21T10:30:00'
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
Credentials are automatically written to `~/.aws/credentials` (default profile).
|
|
163
|
+
|
|
164
|
+
## Multi-Org Workflow
|
|
165
|
+
|
|
166
|
+
Tori supports multiple SSO organizations:
|
|
167
|
+
|
|
168
|
+
1. **Configure multiple orgs**:
|
|
169
|
+
```bash
|
|
170
|
+
tori configure company-prod
|
|
171
|
+
tori configure company-dev
|
|
172
|
+
tori configure client-org
|
|
173
|
+
```
|
|
174
|
+
|
|
175
|
+
2. **Set a default org** (optional):
|
|
176
|
+
```bash
|
|
177
|
+
tori default company-prod
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
3. **Assume roles**:
|
|
181
|
+
```bash
|
|
182
|
+
# Uses default org
|
|
183
|
+
tori assume my-account
|
|
184
|
+
|
|
185
|
+
# Uses specific org
|
|
186
|
+
tori assume my-account company-dev
|
|
187
|
+
```
|
|
188
|
+
|
|
189
|
+
4. **List all orgs**:
|
|
190
|
+
```bash
|
|
191
|
+
tori list
|
|
192
|
+
```
|
|
193
|
+
|
|
194
|
+
## Profile Management
|
|
195
|
+
|
|
196
|
+
When you assume a new role, Tori:
|
|
197
|
+
1. Backs up your current default profile to a named profile
|
|
198
|
+
2. Sets the new credentials as the default profile
|
|
199
|
+
3. Tracks all backed up profiles in the config
|
|
200
|
+
|
|
201
|
+
**Backed up profile naming:** `profile_<account_id>_<role_name>`
|
|
202
|
+
|
|
203
|
+
**View backed up profiles:**
|
|
204
|
+
```bash
|
|
205
|
+
tori status
|
|
206
|
+
```
|
|
207
|
+
|
|
208
|
+
**Switch back to a previous profile:**
|
|
209
|
+
Simply use `tori assume` with the account and role you want to switch to.
|
|
210
|
+
|
|
211
|
+
## How it Works
|
|
212
|
+
|
|
213
|
+
1. **One-time setup per org**: Store your SSO start URL and region
|
|
214
|
+
2. **Automatic caching**: Accounts and roles are cached during configuration
|
|
215
|
+
3. **Explicit refresh**: Only re-fetch accounts when you run `tori refresh`
|
|
216
|
+
4. **Assume roles**:
|
|
217
|
+
- Authenticate via AWS SSO (browser-based, only when needed)
|
|
218
|
+
- Get temporary credentials for the selected account and role
|
|
219
|
+
- Backup current default profile
|
|
220
|
+
- Write new credentials to default AWS profile
|
|
221
|
+
- Use AWS CLI normally!
|
|
222
|
+
|
|
223
|
+
No need to manage multiple profiles manually or remember account details - just use the account name!
|
|
224
|
+
|
|
225
|
+
## Requirements
|
|
226
|
+
|
|
227
|
+
- Python 3.8+
|
|
228
|
+
- boto3 (AWS SDK)
|
|
229
|
+
- click (CLI framework)
|
|
230
|
+
- questionary (interactive prompts)
|
|
231
|
+
- pyyaml (config management)
|
|
232
|
+
- Internet connection for SSO authentication
|
ssof-0.1.0/README.md
ADDED
|
@@ -0,0 +1,217 @@
|
|
|
1
|
+
# Tori - AWS SSO Session Manager
|
|
2
|
+
|
|
3
|
+
Ultra-simple CLI tool to manage AWS SSO sessions across multiple organizations. Configure once per org, then just `tori assume <account>` and you're in!
|
|
4
|
+
|
|
5
|
+
## Installation
|
|
6
|
+
|
|
7
|
+
Tori uses [uv](https://docs.astral.sh/uv/) for dependency management.
|
|
8
|
+
|
|
9
|
+
```bash
|
|
10
|
+
# Install uv if you don't have it
|
|
11
|
+
brew install uv # or: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
12
|
+
|
|
13
|
+
# Sync dependencies and install tori in editable mode
|
|
14
|
+
uv sync
|
|
15
|
+
|
|
16
|
+
# Run tori via uv (no activation needed)
|
|
17
|
+
uv run tori --help
|
|
18
|
+
|
|
19
|
+
# Or activate the venv to use `tori` directly
|
|
20
|
+
source .venv/bin/activate
|
|
21
|
+
tori --help
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
## Quick Start
|
|
25
|
+
|
|
26
|
+
1. **Configure Tori with your SSO details**:
|
|
27
|
+
```bash
|
|
28
|
+
tori configure my-org
|
|
29
|
+
```
|
|
30
|
+
Enter your SSO start URL and region when prompted. Tori will authenticate and cache all available accounts.
|
|
31
|
+
|
|
32
|
+
2. **List available accounts**:
|
|
33
|
+
```bash
|
|
34
|
+
tori list
|
|
35
|
+
```
|
|
36
|
+
This shows all AWS accounts you have access to via SSO across all configured orgs.
|
|
37
|
+
|
|
38
|
+
3. **Assume a role**:
|
|
39
|
+
```bash
|
|
40
|
+
tori assume my-account-name
|
|
41
|
+
```
|
|
42
|
+
This will:
|
|
43
|
+
- Authenticate with AWS SSO (if needed)
|
|
44
|
+
- Get temporary credentials
|
|
45
|
+
- Back up your current default profile (if exists) to a named profile
|
|
46
|
+
- Configure your default AWS CLI profile automatically
|
|
47
|
+
- You're ready to use AWS CLI immediately!
|
|
48
|
+
|
|
49
|
+
## Commands
|
|
50
|
+
|
|
51
|
+
### `tori configure <org-name>`
|
|
52
|
+
Configure AWS SSO settings for an organization. You can configure multiple orgs.
|
|
53
|
+
|
|
54
|
+
**Example:**
|
|
55
|
+
```bash
|
|
56
|
+
tori configure my-company
|
|
57
|
+
# Enter SSO start URL: https://my-company.awsapps.com/start
|
|
58
|
+
# Enter SSO region: us-east-1
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
The first org you configure becomes the default. All accounts will be cached automatically.
|
|
62
|
+
|
|
63
|
+
### `tori assume <account> [org-name]`
|
|
64
|
+
Assume an AWS SSO role and configure the default AWS profile with credentials.
|
|
65
|
+
|
|
66
|
+
**Examples:**
|
|
67
|
+
```bash
|
|
68
|
+
# Assume by account name (uses default org)
|
|
69
|
+
tori assume production
|
|
70
|
+
|
|
71
|
+
# Assume by account ID
|
|
72
|
+
tori assume 123456789012
|
|
73
|
+
|
|
74
|
+
# Assume from specific org
|
|
75
|
+
tori assume production my-company
|
|
76
|
+
|
|
77
|
+
# Assume with specific role (skips interactive selection)
|
|
78
|
+
tori assume production my-company --role AdminRole
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
**Profile Backup:** When you assume a new role, Tori automatically backs up your current default profile to `profile_<account_id>_<role_name>` so you can switch back later.
|
|
82
|
+
|
|
83
|
+
### `tori refresh [org-name]`
|
|
84
|
+
Refresh cached accounts for an organization. Use this when new accounts or roles are added.
|
|
85
|
+
|
|
86
|
+
**Examples:**
|
|
87
|
+
```bash
|
|
88
|
+
# Refresh default org
|
|
89
|
+
tori refresh
|
|
90
|
+
|
|
91
|
+
# Refresh specific org
|
|
92
|
+
tori refresh my-company
|
|
93
|
+
```
|
|
94
|
+
|
|
95
|
+
### `tori list [org-name]`
|
|
96
|
+
List all configured orgs and their AWS SSO accounts.
|
|
97
|
+
|
|
98
|
+
**Examples:**
|
|
99
|
+
```bash
|
|
100
|
+
# List all orgs and accounts
|
|
101
|
+
tori list
|
|
102
|
+
|
|
103
|
+
# List accounts for specific org
|
|
104
|
+
tori list my-company
|
|
105
|
+
```
|
|
106
|
+
|
|
107
|
+
### `tori status`
|
|
108
|
+
Check your current AWS credentials status and see all backed up profiles.
|
|
109
|
+
|
|
110
|
+
### `tori default <org-name>`
|
|
111
|
+
Set the default organization to use when org name is not specified.
|
|
112
|
+
|
|
113
|
+
**Example:**
|
|
114
|
+
```bash
|
|
115
|
+
tori default my-company
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
## Configuration
|
|
119
|
+
|
|
120
|
+
Tori stores its configuration in `~/.tori/config.yaml`:
|
|
121
|
+
|
|
122
|
+
```yaml
|
|
123
|
+
default_org: my-company
|
|
124
|
+
orgs:
|
|
125
|
+
my-company:
|
|
126
|
+
sso_start_url: https://my-company.awsapps.com/start
|
|
127
|
+
sso_region: us-east-1
|
|
128
|
+
cached_accounts:
|
|
129
|
+
production:
|
|
130
|
+
accountId: '123456789012'
|
|
131
|
+
accountName: production
|
|
132
|
+
email: aws-prod@company.com
|
|
133
|
+
roles:
|
|
134
|
+
- AdminRole
|
|
135
|
+
- ReadOnlyRole
|
|
136
|
+
another-org:
|
|
137
|
+
sso_start_url: https://another-org.awsapps.com/start
|
|
138
|
+
sso_region: us-west-2
|
|
139
|
+
cached_accounts: {}
|
|
140
|
+
active_profiles:
|
|
141
|
+
profile_123456789012_AdminRole:
|
|
142
|
+
account_id: '123456789012'
|
|
143
|
+
role_name: AdminRole
|
|
144
|
+
timestamp: '2025-11-21T10:30:00'
|
|
145
|
+
```
|
|
146
|
+
|
|
147
|
+
Credentials are automatically written to `~/.aws/credentials` (default profile).
|
|
148
|
+
|
|
149
|
+
## Multi-Org Workflow
|
|
150
|
+
|
|
151
|
+
Tori supports multiple SSO organizations:
|
|
152
|
+
|
|
153
|
+
1. **Configure multiple orgs**:
|
|
154
|
+
```bash
|
|
155
|
+
tori configure company-prod
|
|
156
|
+
tori configure company-dev
|
|
157
|
+
tori configure client-org
|
|
158
|
+
```
|
|
159
|
+
|
|
160
|
+
2. **Set a default org** (optional):
|
|
161
|
+
```bash
|
|
162
|
+
tori default company-prod
|
|
163
|
+
```
|
|
164
|
+
|
|
165
|
+
3. **Assume roles**:
|
|
166
|
+
```bash
|
|
167
|
+
# Uses default org
|
|
168
|
+
tori assume my-account
|
|
169
|
+
|
|
170
|
+
# Uses specific org
|
|
171
|
+
tori assume my-account company-dev
|
|
172
|
+
```
|
|
173
|
+
|
|
174
|
+
4. **List all orgs**:
|
|
175
|
+
```bash
|
|
176
|
+
tori list
|
|
177
|
+
```
|
|
178
|
+
|
|
179
|
+
## Profile Management
|
|
180
|
+
|
|
181
|
+
When you assume a new role, Tori:
|
|
182
|
+
1. Backs up your current default profile to a named profile
|
|
183
|
+
2. Sets the new credentials as the default profile
|
|
184
|
+
3. Tracks all backed up profiles in the config
|
|
185
|
+
|
|
186
|
+
**Backed up profile naming:** `profile_<account_id>_<role_name>`
|
|
187
|
+
|
|
188
|
+
**View backed up profiles:**
|
|
189
|
+
```bash
|
|
190
|
+
tori status
|
|
191
|
+
```
|
|
192
|
+
|
|
193
|
+
**Switch back to a previous profile:**
|
|
194
|
+
Simply use `tori assume` with the account and role you want to switch to.
|
|
195
|
+
|
|
196
|
+
## How it Works
|
|
197
|
+
|
|
198
|
+
1. **One-time setup per org**: Store your SSO start URL and region
|
|
199
|
+
2. **Automatic caching**: Accounts and roles are cached during configuration
|
|
200
|
+
3. **Explicit refresh**: Only re-fetch accounts when you run `tori refresh`
|
|
201
|
+
4. **Assume roles**:
|
|
202
|
+
- Authenticate via AWS SSO (browser-based, only when needed)
|
|
203
|
+
- Get temporary credentials for the selected account and role
|
|
204
|
+
- Backup current default profile
|
|
205
|
+
- Write new credentials to default AWS profile
|
|
206
|
+
- Use AWS CLI normally!
|
|
207
|
+
|
|
208
|
+
No need to manage multiple profiles manually or remember account details - just use the account name!
|
|
209
|
+
|
|
210
|
+
## Requirements
|
|
211
|
+
|
|
212
|
+
- Python 3.8+
|
|
213
|
+
- boto3 (AWS SDK)
|
|
214
|
+
- click (CLI framework)
|
|
215
|
+
- questionary (interactive prompts)
|
|
216
|
+
- pyyaml (config management)
|
|
217
|
+
- Internet connection for SSO authentication
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=61.0", "wheel"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "ssof"
|
|
7
|
+
version = "0.1.0"
|
|
8
|
+
description = "A simple CLI tool to manage AWS SSO sessions"
|
|
9
|
+
authors = [{ name = "Your Name", email = "your.email@example.com" }]
|
|
10
|
+
readme = "README.md"
|
|
11
|
+
requires-python = ">=3.10"
|
|
12
|
+
license = { text = "MIT" }
|
|
13
|
+
dependencies = [
|
|
14
|
+
"click>=8.3.0",
|
|
15
|
+
"boto3>=1.43.0",
|
|
16
|
+
"questionary>=2.1.0",
|
|
17
|
+
]
|
|
18
|
+
|
|
19
|
+
[project.scripts]
|
|
20
|
+
ssof = "tori.cli:cli"
|
|
21
|
+
|
|
22
|
+
[project.optional-dependencies]
|
|
23
|
+
dev = [
|
|
24
|
+
"pytest>=9.0.0",
|
|
25
|
+
"black>=26.0.0",
|
|
26
|
+
]
|
ssof-0.1.0/setup.cfg
ADDED
|
@@ -0,0 +1,232 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: ssof
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: A simple CLI tool to manage AWS SSO sessions
|
|
5
|
+
Author-email: Your Name <your.email@example.com>
|
|
6
|
+
License: MIT
|
|
7
|
+
Requires-Python: >=3.10
|
|
8
|
+
Description-Content-Type: text/markdown
|
|
9
|
+
Requires-Dist: click>=8.3.0
|
|
10
|
+
Requires-Dist: boto3>=1.43.0
|
|
11
|
+
Requires-Dist: questionary>=2.1.0
|
|
12
|
+
Provides-Extra: dev
|
|
13
|
+
Requires-Dist: pytest>=9.0.0; extra == "dev"
|
|
14
|
+
Requires-Dist: black>=26.0.0; extra == "dev"
|
|
15
|
+
|
|
16
|
+
# Tori - AWS SSO Session Manager
|
|
17
|
+
|
|
18
|
+
Ultra-simple CLI tool to manage AWS SSO sessions across multiple organizations. Configure once per org, then just `tori assume <account>` and you're in!
|
|
19
|
+
|
|
20
|
+
## Installation
|
|
21
|
+
|
|
22
|
+
Tori uses [uv](https://docs.astral.sh/uv/) for dependency management.
|
|
23
|
+
|
|
24
|
+
```bash
|
|
25
|
+
# Install uv if you don't have it
|
|
26
|
+
brew install uv # or: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
27
|
+
|
|
28
|
+
# Sync dependencies and install tori in editable mode
|
|
29
|
+
uv sync
|
|
30
|
+
|
|
31
|
+
# Run tori via uv (no activation needed)
|
|
32
|
+
uv run tori --help
|
|
33
|
+
|
|
34
|
+
# Or activate the venv to use `tori` directly
|
|
35
|
+
source .venv/bin/activate
|
|
36
|
+
tori --help
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
## Quick Start
|
|
40
|
+
|
|
41
|
+
1. **Configure Tori with your SSO details**:
|
|
42
|
+
```bash
|
|
43
|
+
tori configure my-org
|
|
44
|
+
```
|
|
45
|
+
Enter your SSO start URL and region when prompted. Tori will authenticate and cache all available accounts.
|
|
46
|
+
|
|
47
|
+
2. **List available accounts**:
|
|
48
|
+
```bash
|
|
49
|
+
tori list
|
|
50
|
+
```
|
|
51
|
+
This shows all AWS accounts you have access to via SSO across all configured orgs.
|
|
52
|
+
|
|
53
|
+
3. **Assume a role**:
|
|
54
|
+
```bash
|
|
55
|
+
tori assume my-account-name
|
|
56
|
+
```
|
|
57
|
+
This will:
|
|
58
|
+
- Authenticate with AWS SSO (if needed)
|
|
59
|
+
- Get temporary credentials
|
|
60
|
+
- Back up your current default profile (if exists) to a named profile
|
|
61
|
+
- Configure your default AWS CLI profile automatically
|
|
62
|
+
- You're ready to use AWS CLI immediately!
|
|
63
|
+
|
|
64
|
+
## Commands
|
|
65
|
+
|
|
66
|
+
### `tori configure <org-name>`
|
|
67
|
+
Configure AWS SSO settings for an organization. You can configure multiple orgs.
|
|
68
|
+
|
|
69
|
+
**Example:**
|
|
70
|
+
```bash
|
|
71
|
+
tori configure my-company
|
|
72
|
+
# Enter SSO start URL: https://my-company.awsapps.com/start
|
|
73
|
+
# Enter SSO region: us-east-1
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
The first org you configure becomes the default. All accounts will be cached automatically.
|
|
77
|
+
|
|
78
|
+
### `tori assume <account> [org-name]`
|
|
79
|
+
Assume an AWS SSO role and configure the default AWS profile with credentials.
|
|
80
|
+
|
|
81
|
+
**Examples:**
|
|
82
|
+
```bash
|
|
83
|
+
# Assume by account name (uses default org)
|
|
84
|
+
tori assume production
|
|
85
|
+
|
|
86
|
+
# Assume by account ID
|
|
87
|
+
tori assume 123456789012
|
|
88
|
+
|
|
89
|
+
# Assume from specific org
|
|
90
|
+
tori assume production my-company
|
|
91
|
+
|
|
92
|
+
# Assume with specific role (skips interactive selection)
|
|
93
|
+
tori assume production my-company --role AdminRole
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
**Profile Backup:** When you assume a new role, Tori automatically backs up your current default profile to `profile_<account_id>_<role_name>` so you can switch back later.
|
|
97
|
+
|
|
98
|
+
### `tori refresh [org-name]`
|
|
99
|
+
Refresh cached accounts for an organization. Use this when new accounts or roles are added.
|
|
100
|
+
|
|
101
|
+
**Examples:**
|
|
102
|
+
```bash
|
|
103
|
+
# Refresh default org
|
|
104
|
+
tori refresh
|
|
105
|
+
|
|
106
|
+
# Refresh specific org
|
|
107
|
+
tori refresh my-company
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
### `tori list [org-name]`
|
|
111
|
+
List all configured orgs and their AWS SSO accounts.
|
|
112
|
+
|
|
113
|
+
**Examples:**
|
|
114
|
+
```bash
|
|
115
|
+
# List all orgs and accounts
|
|
116
|
+
tori list
|
|
117
|
+
|
|
118
|
+
# List accounts for specific org
|
|
119
|
+
tori list my-company
|
|
120
|
+
```
|
|
121
|
+
|
|
122
|
+
### `tori status`
|
|
123
|
+
Check your current AWS credentials status and see all backed up profiles.
|
|
124
|
+
|
|
125
|
+
### `tori default <org-name>`
|
|
126
|
+
Set the default organization to use when org name is not specified.
|
|
127
|
+
|
|
128
|
+
**Example:**
|
|
129
|
+
```bash
|
|
130
|
+
tori default my-company
|
|
131
|
+
```
|
|
132
|
+
|
|
133
|
+
## Configuration
|
|
134
|
+
|
|
135
|
+
Tori stores its configuration in `~/.tori/config.yaml`:
|
|
136
|
+
|
|
137
|
+
```yaml
|
|
138
|
+
default_org: my-company
|
|
139
|
+
orgs:
|
|
140
|
+
my-company:
|
|
141
|
+
sso_start_url: https://my-company.awsapps.com/start
|
|
142
|
+
sso_region: us-east-1
|
|
143
|
+
cached_accounts:
|
|
144
|
+
production:
|
|
145
|
+
accountId: '123456789012'
|
|
146
|
+
accountName: production
|
|
147
|
+
email: aws-prod@company.com
|
|
148
|
+
roles:
|
|
149
|
+
- AdminRole
|
|
150
|
+
- ReadOnlyRole
|
|
151
|
+
another-org:
|
|
152
|
+
sso_start_url: https://another-org.awsapps.com/start
|
|
153
|
+
sso_region: us-west-2
|
|
154
|
+
cached_accounts: {}
|
|
155
|
+
active_profiles:
|
|
156
|
+
profile_123456789012_AdminRole:
|
|
157
|
+
account_id: '123456789012'
|
|
158
|
+
role_name: AdminRole
|
|
159
|
+
timestamp: '2025-11-21T10:30:00'
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
Credentials are automatically written to `~/.aws/credentials` (default profile).
|
|
163
|
+
|
|
164
|
+
## Multi-Org Workflow
|
|
165
|
+
|
|
166
|
+
Tori supports multiple SSO organizations:
|
|
167
|
+
|
|
168
|
+
1. **Configure multiple orgs**:
|
|
169
|
+
```bash
|
|
170
|
+
tori configure company-prod
|
|
171
|
+
tori configure company-dev
|
|
172
|
+
tori configure client-org
|
|
173
|
+
```
|
|
174
|
+
|
|
175
|
+
2. **Set a default org** (optional):
|
|
176
|
+
```bash
|
|
177
|
+
tori default company-prod
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
3. **Assume roles**:
|
|
181
|
+
```bash
|
|
182
|
+
# Uses default org
|
|
183
|
+
tori assume my-account
|
|
184
|
+
|
|
185
|
+
# Uses specific org
|
|
186
|
+
tori assume my-account company-dev
|
|
187
|
+
```
|
|
188
|
+
|
|
189
|
+
4. **List all orgs**:
|
|
190
|
+
```bash
|
|
191
|
+
tori list
|
|
192
|
+
```
|
|
193
|
+
|
|
194
|
+
## Profile Management
|
|
195
|
+
|
|
196
|
+
When you assume a new role, Tori:
|
|
197
|
+
1. Backs up your current default profile to a named profile
|
|
198
|
+
2. Sets the new credentials as the default profile
|
|
199
|
+
3. Tracks all backed up profiles in the config
|
|
200
|
+
|
|
201
|
+
**Backed up profile naming:** `profile_<account_id>_<role_name>`
|
|
202
|
+
|
|
203
|
+
**View backed up profiles:**
|
|
204
|
+
```bash
|
|
205
|
+
tori status
|
|
206
|
+
```
|
|
207
|
+
|
|
208
|
+
**Switch back to a previous profile:**
|
|
209
|
+
Simply use `tori assume` with the account and role you want to switch to.
|
|
210
|
+
|
|
211
|
+
## How it Works
|
|
212
|
+
|
|
213
|
+
1. **One-time setup per org**: Store your SSO start URL and region
|
|
214
|
+
2. **Automatic caching**: Accounts and roles are cached during configuration
|
|
215
|
+
3. **Explicit refresh**: Only re-fetch accounts when you run `tori refresh`
|
|
216
|
+
4. **Assume roles**:
|
|
217
|
+
- Authenticate via AWS SSO (browser-based, only when needed)
|
|
218
|
+
- Get temporary credentials for the selected account and role
|
|
219
|
+
- Backup current default profile
|
|
220
|
+
- Write new credentials to default AWS profile
|
|
221
|
+
- Use AWS CLI normally!
|
|
222
|
+
|
|
223
|
+
No need to manage multiple profiles manually or remember account details - just use the account name!
|
|
224
|
+
|
|
225
|
+
## Requirements
|
|
226
|
+
|
|
227
|
+
- Python 3.8+
|
|
228
|
+
- boto3 (AWS SDK)
|
|
229
|
+
- click (CLI framework)
|
|
230
|
+
- questionary (interactive prompts)
|
|
231
|
+
- pyyaml (config management)
|
|
232
|
+
- Internet connection for SSO authentication
|