DEV Community

Cover image for aws console: open the AWS Console from your terminal, in one command
AWS Community Builders profile image Paul SANTUS
Paul SANTUS for AWS Community Builders

Posted on

aws console: open the AWS Console from your terminal, in one command

#aws #console #productivity #opensource

When you manage dozens of AWS accounts and roles, opening the Console is a tedious ritual: find the right profile, click to sign in, start over to switch accounts.

I ended up packaging the shortcut I use every day into a dead-simple command:

aws console my-profile
Enter fullscreen mode Exit fullscreen mode

And that's it: the AWS Console opens in your browser, signed in to the right account.

The tools installs in one command and behaves like a native AWS CLI subcommand. Look at it in action:

Installation

Requirements: AWS CLI v2, curl, python3, and SSO / assume-role profiles.

curl -fsSL -o aws-console-url.tar.gz \
  https://github.com/psantus/aws-console-url/archive/refs/tags/v1.1.0.tar.gz
tar xzf aws-console-url.tar.gz
cd aws-console-url-1.0.0
./install.sh
Enter fullscreen mode Exit fullscreen mode

The installer registers two equivalent aliases in ~/.aws/cli/alias:
aws console (short) and aws console-url (explicit). Verify:

aws console my-profile --print   # print the URL instead of opening the browser
Enter fullscreen mode Exit fullscreen mode

Basic use 

aws console my-profile                    # open the account's console
aws console my-profile --print            # just print the sign-in URL
aws console my-profile --region us-east-1 # force the landing region
aws console my-profile --browser "Safari" # pick the browser
Enter fullscreen mode Exit fullscreen mode

By default the URL opens in your system browser (macOS, Linux, and WSL/Git Bash on Windows are supported). To pin one, on macOS:

export AWS_CONSOLE_BROWSER="Google Chrome"
Enter fullscreen mode Exit fullscreen mode

Jump straight to a service

A second argument (or --service) takes you directly to a service's console, not just the home page:

aws console my-profile ec2        # open the EC2 console directly
aws console my-profile s3         # S3 (global console)
aws console my-profile lambda     # Lambda in the right region
aws console my-profile --service rds
Enter fullscreen mode Exit fullscreen mode

Most services resolve to /<service>/home; a few special cases (s3, iam, route53, billing are global; stepfunctions → states) are handled automatically. For any exotic deep-link, --destination <url> is still available.

Multi-session, for free

The AWS Console lets you be signed in to up to 5 accounts simultaneously in the same browser.

The tool enables this automatically: each profile opens in its own session instead of overwriting the previous one.

aws console account-a    # session A
aws console account-b    # session B, in parallel — both stay signed in
Enter fullscreen mode Exit fullscreen mode

The first time, the Console shows an "Enable multi-session" prompt: one click, once per browser, and you're set. (--no-multi to go back to classic single-session behavior.)

BONUS : my personal shell alias trio: al / ap / ac

To move even faster day to day, a shell/aws-helpers.sh file provides three functions to source from your ~/.zshrc (or ~/.bashrc):

alias shortcut to
al perform aws sso login: ensure a valid SSO session exists idempotent)
ap set profile: set the ambient AWS_PROFILE
ac console: open the console (ac <profile>, or just ac after ap) 
source /path/to/aws-console-url/shell/aws-helpers.sh
export AWS_DEFAULT_SSO_PROFILE="my-sso-profile"   # optional, used by al
Enter fullscreen mode Exit fullscreen mode

The typical workflow becomes:

al                 # make sure you're logged in
ap my-profile      # pick a profile
ac                 # open its console (uses $AWS_PROFILE)
ac other-account   # ...or a different one explicitly (multi-session)
Enter fullscreen mode Exit fullscreen mode

ac accepts either an explicit profile or the $AWS_PROFILE set by ap, and passes all options through to aws console.

And for maximum comfort, a zsh completion shell/completion.zsh) tab-completes profile names (read live from your AWS config), services and options:

ac de<TAB>            # → dev-readonly  dev-admin  …
ac my-profile e<TAB>  # → ec2  ecs  ecr  efs  events  …
Enter fullscreen mode Exit fullscreen mode

How it works; a note on security

Under the hood, the tool relies entirely on the AWS CLI and on the
AWS federation sign-in flow documented by AWS:

aws console <profile>
        │
        ├─ aws configure export-credentials  → temporary credentials (the CLI handles SSO/STS)
        ├─ aws sts get-caller-identity        → account id
        │
        ├─ GET signin.aws.amazon.com/federation?Action=getSigninToken
        └─ open  signin.aws.amazon.com/federation?Action=login&...   (browser)
Enter fullscreen mode Exit fullscreen mode

It reinvents nothing: the AWS CLI resolves the credentials, and the tool just builds the Console sign-in URL. As a nice side effect, that makes it 100% auditable (~150 lines of bash): it never reads your SSO token cache, never stores any credential, and only ever contacts signin.aws.amazon.com, so there's no room for credentials exfiltration.

It's open source

The code is MIT-licensed, on GitHub. If the tool saves you time, you can sponsor me ☕.

Top comments (0)