from aws sso pages, generate profile entries for ~/.aws/config

aws-sso-profiles-gen.sh

#!/bin/bash
PORTALBASE=https://portal.sso.ap-southeast-2.amazonaws.com
REGION=ap-southeast-2
headers="-H 'X-Amz-Sso-Bearer-Token: $TOKEN' -H 'x-amz-sso_bearer_token: $TOKEN'"

if [ -z "$TOKEN" ]; then
  echo "Must set $TOKEN before running. Get it from browser login to sso portal, and check header for x-amz-sso_bearer_token"
  return 1
fi

get() {
  if [ -z "$1" ]; then
    echo "Usage: get url"
    return 1
  fi
  local url="$1"
  curl -s -H "x-amz-sso_bearer_token: $TOKEN" -H "x-amz-sso-bearer-token: $TOKEN" "$PORTALBASE/$url"
}

#get 'token/whoAmI'
instances=`get 'instance/appinstances'`
accounts=`get 'instance/appinstances' | jq -r .result[]`
jq -c '.' <<< "$accounts" | while read account; do
  account_id=$(echo $account | jq -r .searchMetadata.AccountId)
  account_name=$(echo $account | jq -r .searchMetadata.AccountName)
  account_name=$(echo $account_name | tr '[:upper:]' '[:lower:]' | tr ' ' '-')
  account_app_instance_id=$(echo $account | jq -r .id)
  profiles=$(get "instance/appinstance/${account_app_instance_id}/profiles" | jq -r .result[])
  jq -rc '.' <<< "$profiles" | while read profile; do
    role_name=$(echo $profile | jq -r .name)
    profile_name=$(echo ${account_name}-${role_name})

cat << EOT

[profile ${profile_name}]
sso_session=asa
sso_account_id=${account_id}
sso_role_name=${role_name}
region=ap-southeast-2
EOT

  done
done