Keycloak SSO

Instructions to access AWS resources using Keycloak Saritasa SSO

Install tools

Update profile

~/.ksso_config.toml

Create this file locally with the following content:

[sso]
sso_domain = "https://keycloak.saritasa.cloud"
sso_realm = "saritasa"
sso_agent_port = 8201

~/.aws/config

Update locally:

Make sure to set a full path for the **--config** option, don't use **~**, as it's not expanded inside credential_process.

Devops

[profile igaawi/keycloak/administrators]
region=us-west-2
credential_process=ksso login --json --client-id igaawi-aws-devops --aws-role-arn arn:aws:iam::187528943262:role/igaawi-prod-keycloak-sso-administrators-role 2>/dev/null | sed -n "/^{/,\$p"

Developers

[profile igaawi/keycloak/developers]
region=us-west-2
credential_process=ksso login --json --client-id igaawi-aws-developers --aws-role-arn arn:aws:iam::187528943262:role/igaawi-prod-keycloak-sso-developers-role 2>/dev/null | sed -n "/^{/,\$p"

Authenticate into aws

Execute single shell command

This will provide short-term cached AWS credentials for a single invocation of the command.

➜ aws-vault exec igaawi/keycloak/administrators -- aws s3 ls

2026-06-06 01:22:23 igaawi-prod-api-backend-bucket
2026-06-29 13:21:47 igaawi-prod-docs-bucket
2026-06-05 20:42:44 igaawi-prod-eks-backup
2026-06-05 20:42:49 igaawi-prod-eks-loki-admin
2026-06-05 20:42:49 igaawi-prod-eks-loki-chunks
2026-06-05 20:42:49 igaawi-prod-eks-loki-ruler
2026-06-05 20:42:45 igaawi-prod-eks-tekton-logs
2026-06-05 20:42:45 igaawi-prod-eks-teleport-sessions
2026-06-05 20:42:44 igaawi-prod-eks-tempo

Obtain short-term credentials in the shell

➜ aws-vault exec igaawi/keycloak/administrators
Starting subshell /bin/zsh, use `exit` to exit the subshell
Agent pid 617453


➜ aws s3 ls | wc -l
9

➜ aws sts get-caller-identity
{
    "UserId": "AROASXKMYS2PC2A5ZP5CB:rostislav-udaltsov",
    "Account": "187528943262",
    "Arn": "arn:aws:sts::187528943262:assumed-role/igaawi-prod-keycloak-sso-administrators-role/rostislav-udaltsov"
}

Open GUI AWS Console

➜ aws-vault login igaawi/keycloak/administrators

This will open your default browser and authenticate you into AWS Console based on the OIDC role mapped in the keycloak instance.