Well, one useful extension would be to break the account IDs and role names apart into two selections. So you'd first pick the account, then pick the role within that account. If there is only one account the account question should be skipped. Ditto for the role. Then you could introduce your account ID alias feature to help identify the IDs. Would prefer to see both the account ID and alias (if it exists) in the selection. Not sure the best solution for requesting the input from the user in the config though...

This sounds good. Maybe provide another CLI flag to manage the mapping?

--profile ... --account-alias "<accountnum>=<alias>,<accountnum>=<alias>"

Specifying a zero-length alias removes the mapping. This way we can distribute a file to users, and they can aws-azure-cli --profile my_company --account-alias $(cat file).

Thoughts?

If there's a way to not avoid going to this url, the page could be scraped to get the account aliases.

You'd have to test to see if that would causes issues with using the claim twice.

I'm surprised this issue has received so little attention. It's almost impossible to find the appropriate role with a large number of accounts - each with multiple roles. How could the list be broken down by account name or alias? The comments above seem outdated. If anyone has some good pointers I could potentially look into it myself to see what I can come up with.

@stephenmuss, I think you can try to tweak https://github.com/sportradar/aws-azure-login/blob/main/src/login.ts#L869-L875

So far as I can tell, it's necessary to stop closing the browser before it loads https://signin.aws.amazon.com/saml and then scrape the account aliases from there.

Is there any update on this issue? I'd be interested in seeing the linked PR merged to resolve this.