awsso

A tiny terminal UI for logging into AWS SSO. It reads your ~/.aws/config, shows a checklist of local profiles and configured remote machines, then logs into everything you select:

• Local profiles → runs aws sso login --profile <name> here (opens your browser as usual).
• Remote machines → runs a headless aws sso login --no-browser --use-device-code over ssh, grabs the device-authorization URL it prints (the one with user_code= in it), and opens that in your local browser — so you can authorize a login on a headless box without a browser on the box.

--use-device-code is deliberate: the AWS CLI's default SSO flow redirects to a http://127.0.0.1:<port> callback on the remote, which a browser on your machine can't reach. The device-code flow has the remote poll the token endpoint instead, so opening the URL locally actually completes the login over there.

Build

go build -o awsso .

Optionally put it on your PATH:

go install .

Usage

awsso

Key	Action
↑/↓, k/j	move cursor
space / x	toggle selection
a	select / deselect all
enter	log into selected
q / esc	quit

After enter, the TUI exits and the logins run with output connected to your terminal, so the normal SSO flow (and any ssh prompts) work as usual. Profiles sharing an sso_session reuse the cached token, so only the first triggers a browser.

Non-interactive

Pass names to skip the menu and log into them directly:

awsso dev build-box      # a local profile and a remote machine
awsso --help             # list available names

A name matches a profile name, or a machine's display name / ssh host / the part after @.

Configuring remote machines

Register machines from the command line:

awsso add you@build-box --profile dev --name build-box --region eu-central-1
awsso list                 # show configured profiles and machines

add appends a new host, or updates an existing one in place (matched by host). Only <host> is required; --profile, --name, and --region are optional.

Machines are stored in ~/.config/awsso/config.json (override with AWSSO_CONFIG, or XDG_CONFIG_HOME). An empty file is created on first run. You can also edit it by hand:

{
  "machines": [
    {
      "host": "you@build-box",
      "name": "build-box",
      "profile": "dev",
      "region": "eu-central-1"
    }
  ]
}

Field	Required	Meaning
host	yes	ssh target, e.g. you@build-box or a ~/.ssh/config alias
name	no	display name in the menu (defaults to host)
profile	no	aws profile to log into remotely (--profile)
region	no	informational, shown in the menu

Set profile unless the remote's default profile is SSO-configured — otherwise the remote login fails with "Missing the following required SSO configuration values: sso_start_url, sso_region". Logging in via any profile authenticates its whole sso_session, so one profile per shared session is enough.

The remote machine needs the aws CLI installed and its own ~/.aws/config. ssh auth should be non-interactive (key-based); password/host-key prompts go to your terminal but won't work without an allocated TTY.

Requirements

• Go 1.26+
• The aws CLI on your PATH (locally, and on each remote machine)
• A local browser opener: open (macOS), xdg-open (Linux), or Windows default