Configurable SSO directories

[nazarewk]

Allows configuring SSO directories explicitly in addition to more sane defaults (discovering them from AWS SDK credentials/config file locations).

[jaen]

This would be very useful to me, as I usually keep AWS stuff in a directory scoped to a project using direnv and AWS SSO util kind of ignores that.

[benkehoe]

I'm open to this, but I'd rather see it implemented on the AWS CLI (/botocore) instead, so that it's not specific to aws-sso-util. Could you open an issue/PR there first to see if they're open to it? A workaround like this in aws-sso-util would be the backup if they aren't.

[benkehoe]

It also occurred to me that it may be dangerous to allow an environment variable to tell it where to put credentials. A bit like the redirect on an OAuth flow. I'll have to think more about that, seek some advice.

[nazarewk]

It also occurred to me that it may be dangerous to allow an environment variable to tell it where to put credentials. A bit like the redirect on an OAuth flow. I'll have to think more about that, seek some advice.

While I agree it should be stored in secret-service (or something similar) instead, the AWS SDK already set the precedence on storing credentials in files pointed to by envvars.

I'm open to this, but I'd rather see it implemented on the AWS CLI (/botocore) instead, so that it's not specific to aws-sso-util. Could you open an issue/PR there first to see if they're open to it? A workaround like this in aws-sso-util would be the backup if they aren't.

I'll take a look at viability of implementing it in botocore when i have some free time (most likely not in the next ~3 weeks).

[benkehoe]

The AWS SDK generally has the capability for you to tell it where to get credentials that you've already stored (e.g., with AWS_SHARED_CREDENTIALS_FILE), which is different from telling it where to put cached credentials. Does that make sense?

[nazarewk]

You're right, AWS SDK does not store, only reads the credentials.

[nazarewk]

FYI: looks like you already made a feature request to botocore boto/botocore#1923 ?

[benkehoe]

boto/botocore#1923 is different. It's asking for the functionality of aws_sso_lib.get_boto3_session() to be native in boto3.