Skip to main content

AWS CLI authentication

You can use the authentik Agent to authenticate to the AWS CLI with authentik credentials.

Prerequisites​

authentik configuration​

To support the integration of authentik Agent with AWS CLI, you need to create an application/provider pair in authentik.

Create an application and provider in authentik for AWS CLI​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click Create with Provider to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)

    • Application: provide a descriptive name (e.g. authentik-aws-cli), an optional group for the type of application, the policy engine mode, and optional UI settings.
    • Choose a Provider type: select OAuth2/OpenID Connect as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Set the Client type to Public.
      • Set the Client ID to authentik-aws-cli.
      • Select any available signing key.
      • Under Machine-to-Machine authentication settings add the authentik-cli provider as a Federated OIDC Provider.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage access to the application.

  3. Click Submit to save the new application and provider.

AWS configuration​

To support the integration of AWS with the authentik Agent, you need to configure authentik CLI as an IDP and setup permission roles in AWS.

Configure authentik CLI as an IDP in AWS​

  1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
  2. Open the IAM Console and in the left sidebar under Access Management, click Identity providers.
  3. Click Add provider and configure the following fields:
    • Provider type: OpenID Connect
    • Provider URL: https://authentik.company/application/o/<application-slug>/
    • Audience: authentik-aws-cli
  4. Click Add provider
  5. On the Identity providers page, click on the name of the provider that you just added.

Configure permissions in AWS​

  1. Log in to the AWS Management Console as an administrator that has permissions to create IAM roles and identity providers.
  2. Open the IAM Console and in the left sidebar under Access Management, click Roles.
  3. Either create or edit a role that you want authentik users to be able to use.
  4. Open the Trust relationships tab.
  5. Click Edit trust policy and add the following, replacing <account_id> with your AWS Account ID:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<account_id>:oidc-provider/authentik.company/application/o/authentik-aws-cli/"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "authentik.company/application/o/authentik-aws-cli/:aud": "authentik-aws-cli"
                }
            }
        }
    ]
}
  1. Click Update policy.
  2. Take note of the role ARN as it will be required in the next section.

Configure AWS CLI to authenticate with authentik CLI​

On the device running AWS CLI, update the ~/.aws/credentials file with the following, replacing <role_arn> with the ARN of the role above:

[default]
credential_process = ak auth aws --client-id authentik-aws-cli --role-arn <role_arn>

To verify, run aws sts get-caller-identity, which should output something like this

{
    "UserId": "xxxxxx",
    "Account": "<account_id>",
    "Arn": "arn:aws:sts::<account_id>:assumed-role/<role name>/<authentik username>"
}