Aws-cli: [v2] aws sso commands should allow opting out of automatically opening a browser

[mmerickel]

Is your feature request related to a problem? Please describe.
I'm using a remote shell via SSH to a machine that has a GUI (macOS). When performing aws configure sso or aws sso login it dumps out the url and code to enter into a browser myself. However, the browser has already opened on the remote machine even though I cannot easily access it (nor want to). AWS does not allow me to use the url and code from the console in this scenario to login from my host machine because it was already used by the remote, unseen, browser.

Describe the solution you'd like
A CLI flag like --no-browser to avoid launching the default browser on the system, allowing me to use the url and code myself manually.

Describe alternatives you've considered
A CLI interactive prompt asking whether you'd like to open the default browser. I like this too, and think it should exist before automatically opening another window on my system, but I feel like CLI flags should always exist as well.

[kdaily]

Hi @mmerickel, it looks like this request is similar to #5061. If so, I'll link it there and mark it as a duplicate. Thanks!

[mmerickel]

I think my ticket was a bit more detailed and is actually about machines that do have a browser versus machines that don't. However the final feature implemented should definitely satisfy both use cases. The referenced issue also does not mention aws configure sso, only aws sso login.

[joguSD]

@mmerickel This is definitely a reasonable feature request to have something explicit to say "don't open a browser". We went back and forth on whether or not we should open a browser at all, should it be the default, etc. when implementing this initially and opted to try and be smart and always try to open the browser with some fallback text.

Because we use webbrowser stdlib module: https://docs.python.org/2/library/webbrowser.html
It should be possible to set the BROWSER env var to something else that acts like a no-op as a workaround. For example, you could try using true:

BROWSER=true aws sso login

Let me know if that works for you in the interim.

[mmerickel]

@joguSD this approach does work perfectly for me. Thank you for that. It appears the code does not know whether it opened the browser or not - if it did then there could be a lot of improved messaging here.

[jghal]

My organization has multiple proxies and gives us multiple domain accounts for different roles, it's almost never the case that my default browser is either logged into the domain account I need to use for the SSO login or using the proxy to meet source IP CIDR firewall rules. I can't get that ENV variable to work on Windows. I have to wait for the CLI to open my default browser and frantically ESC then CTRL-W and hope I caught it in time, then open my other browser that will work for the login.

Even though you have support for using elinks when on a headless connection to a linux machine, I've never seen elinks not fail on cert validation of the SSO login URL. For a while I was having to sudo chmod -x $(which elinks) to do the SSO login, but the BROWSER env variable seems to work on Linux. But having a proper set of CLI arguments would be preferred for cross-platform consistenty.

[huntsfromshadow]

This is an issue for me. For some reason my AV has decided that anytime a browser is launched in WSL it's a 'suspicious behavior'.
It would be easier just have aws/cli (and amplify) just not launch a browser and let me open the browser manually while the antivirus finally figures out the issue on their side.

[onitake]

BROWSER=true does not work with the webbrowser Python module on my system.
https://docs.python.org/3.8/library/webbrowser.html states that it must be a full path.
BROWSER=/usr/bin/true or BROWSER/usr/bin/echo works.

[kdaily]

Also see #5533.

[n2qz]

BROWSER=true does not work with the webbrowser Python module on my system.
https://docs.python.org/3.8/library/webbrowser.html states that it must be a full path.
BROWSER=/usr/bin/true or BROWSER/usr/bin/echo works.

BROWSER=/usr/bin/echo is great because it produces the full URL for easy one-step copy and paste to a desktop browser. Thanks for the hint!

[AMMullan]

BROWSER=true does not work with the webbrowser Python module on my system.
https://docs.python.org/3.8/library/webbrowser.html states that it must be a full path.
BROWSER=/usr/bin/true or BROWSER/usr/bin/echo works.

BROWSER=/usr/bin/echo is great because it produces the full URL for easy one-step copy and paste to a desktop browser. Thanks for the hint!

That's super useful - not to figure out what it is for Windows users, we have a few of them and this would be quite useful...

[jghal]

not to figure out what it is for Windows users,

I would think that just having a real CLI argument like --no-browser so that it just prints out the URL and code would be the simplest way.

That would work for all platforms.