gimme-aws-creds

Ah, it's SAML-specific (https://sourcegraph.com/github.com/Nike-Inc/gimme-aws-creds/...) although the majority of BS4 seems to be about driving Okta not AWS: https://sourcegraph.com/github.com/Nike-Inc/gimme-aws-creds/... Yeah, SAML is, as far as I know, always headed. My copy of aws-vault is bright enough to launch against our AWS SSO provider(1), which secretly is also SAML to Okta, but I guess if your company's setup doesn't use AWS SSO then Nike must have thought parsing HTML to be The Solution™ 1: https://sourcegraph.com/github.com/99designs/aws-vault/-/blo...

I use this thing Nike made. Looks pretty similar. https://github.com/Nike-Inc/gimme-aws-creds

IAM is going to be "required" for the root account, though, shutting that away is a good practice. In lieu of IAM you can use federated access from an identity provider like Okta. That will lease a role which can then adopt other roles (even across accounts). Okta is integrated with a more formal IT system like Active Directory and then all your accesses and identity can be managed by them. I think this is the AWS side doc for the setup https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr... I also know Nike does something very similar and shared about it here https://github.com/Nike-Inc/gimme-aws-creds including the Okta side documentation.