AWS CLI- Exchange SAML for STS

saml2sts.sh

# Drop this function code in your .bashrc, then call `saml2sts` when you want to authenticate.
# This relies on AWS not restricting SAML Assertion re-use.  They do not, so let's take advantage.
saml2sts() { 
  printf '  * %s\n' 'In your browser, authenticate to AWS using SAML.' 'Capture the SAML assertion in base64 format from IdP and copy it to clipboard.  Copy the whole b64 encoded payload (NOT THE XML!) from SAML Decoder plugin.  Alternatively you can capture the b64 payload with F12 developer tools, which requires no third party browser extensions.'
  read -r -e -p 'SAML Assertion in Base64: ' myAssertion
  mySts="$(aws sts assume-role-with-saml --output text --role-arn arn:aws:iam::000000000000:role/YourRoleName --principal-arn arn:aws:iam::000000000000:saml-provider/SamlIdpName --saml-assertion \"$myAssertion\" --duration-seconds 28800 --query 'Credentials.[AccessKeyId, SecretAccessKey, SessionToken]')" || return; 
  while read access secret session; do printf '[default]\naws_access_key_id=%s\naws_secret_access_key=%s\naws_session_token=%s\n' "$access" "$secret" "$session"; done <<<"$mySts" > ~/.aws/credentials
}