This PowerShell script automates the retrieval of AWS credentials via SSO login and saves them to the .aws/credentials file. Supports fetching credentials for all profiles, specific profiles, and listing available profiles.

aws.ps1

param(
    [string] $Session = "my-session",
    [string] $Region = "eu-west-1",
    [string] $Profile = "default",

    [Parameter(Mandatory = $false, Position = 0)]  
    [string]$Mode = "help"
)

function Login {
    Write-Host "Starting SSO login. Please authenticate in your browser."
    aws sso login --sso-session $Session 

    if ($LASTEXITCODE -ne 0) {
        Write-Error "SSO login failed. Please check for errors."
        exit 1
    }
    else {
        Write-Host "SSO login complete."
    }
}

function Show-InteractiveProfileMenu {
    $profiles = aws configure list-profiles
    $selected = 0  

    while ($true) {
        

        Clear-Host
        Write-Host "AWS Profile Selection"

        # Menu Display with Formatting
        for ($i = 0; $i -lt $profiles.Count; $i++) {
            if ($i -eq $selected) { 
                Write-Host -BackgroundColor Green -ForegroundColor Black "> $($profiles[$i])" 
            } else {
                Write-Host $profiles[$i] 
            }
        }

        $key = $host.UI.RawUI.ReadKey('IncludeKeyDown')
        if ($key.VirtualKeyCode -eq 38) {  # Up Arrow
            $selected = [Math]::Max($selected - 1, 0)
        } elseif ($key.VirtualKeyCode -eq 40) { # Down Arrow
            $selected = [Math]::Min($selected + 1, $profiles.Count - 1)
        } elseif ($key.VirtualKeyCode -eq 13) { # Enter 
            return $profiles[$selected]
        }
    }
}



function GetCredentials {
    param(
        [string]$ProfileName
    )

    $rawCredentials = aws configure export-credentials --format=env-no-export --profile $ProfileName
    $credentials = @{}

    $rawCredentials -split "`n" | ForEach-Object {
        $parts = $_ -split "=" 
        if ($parts.Length -eq 2) {
            $credentials[$parts[0]] = $parts[1]
        }
    }

    return $credentials
}

function SaveCredential {
    param (
        [hashtable]$credentials,
        [string]$profileName
    )
 
    $credentialContent = @"
[$profileName]
region = $Region
aws_access_key_id=$($credentials.AWS_ACCESS_KEY_ID)
aws_secret_access_key=$($credentials.AWS_SECRET_ACCESS_KEY)
aws_session_token=$($credentials.AWS_SESSION_TOKEN)

"@
    Add-Content -Path "$HOME\.aws\credentials" -Value $credentialContent
}

function SaveAllCredentials {
    $profiles = aws configure list-profiles 

    Clear-Content -Path "$HOME\.aws\credentials"

    foreach ($profileName in $profiles) {
        Write-Host "Loading $profileName credentials "
        $credentials = GetCredentials -ProfileName $profileName
        if ($LASTEXITCODE -ne 0) {
            continue
        }
        SaveCredential -Credential $credentials -profileName $profileName
    }
}

function Show-Help {
    Write-Host "--------------------------------------------------"
    Write-Host "AWS Credential Management Script"
    Write-Host "--------------------------------------------------"
    Write-Host "Usage:  aws.ps1 [command] [option]"
    Write-Host ""
    Write-Host "Supported Commands:"
    Write-Host "  login     |  login using configured sso-session."
    Write-Host "  cred      |  prints credentials for the requested profile."
    Write-Host "  menu      |  Lists all available AWS profiles. and let you select a profile to load"
    Write-Host "  <profile> |  Loads credentials for a specific profile and saves them as [default]."
    Write-Host "  all       |  Loads and saves credentials for all available profiles."
    Write-Host "  list      |  Lists all available AWS profiles."
    Write-Host "  help      |  Displays this help message."
    Write-Host "--------------------------------------------------"
    Write-Host "Supported Options:"
    Write-Host "  -Session  |  default 'my-session'"
    Write-Host "  -Profile  |  default 'default'"
    Write-Host "  -Region   |  default 'eu-west-1'"
    Write-Host "--------------------------------------------------"
}

try {
    if ($Mode -eq "all") {
        SaveAllCredentials
        Write-Host "All credentials saved successfully!"
    }
    elseif ($Mode -eq "help") {
        Show-Help
    }
    elseif ($Mode -eq "cred") {
        GetCredentials -ProfileName $Profile
    }
    elseif ($Mode -eq "list") {
        aws configure list-profiles
    }
    elseif ($Mode -eq "login") {
        Login
    }
    elseif ($Mode -eq "menu") {
        $selectedProfile = Show-InteractiveProfileMenu

        $credentials = GetCredentials -ProfileName $selectedProfile
        if ($LASTEXITCODE -ne 0) {
            exit 1
        }
        Clear-Content -Path "$HOME\.aws\credentials"
        SaveCredential -Credential $credentials -profileName "default"
        Clear-Host
        Write-Host "$selectedProfile credentials successfully saved as default profile!" 
    }
    else {
        $credentials = GetCredentials -ProfileName $Mode
        if ($LASTEXITCODE -ne 0) {
            exit 1
        }
        Clear-Content -Path "$HOME\.aws\credentials"
        SaveCredential -Credential $credentials -profileName "default"
        Write-Host "$profileName credentials successfully saved as default profile!"    
    }
}

catch {
    Write-Error $_.Exception.Message
}