A role list as long as your org chart
The AWS SAML sign-in page lists every account and role you have in one long, unsorted column of radio buttons.
Filters, tags, search and favourites find the role in a keystroke.
Free Chrome extension for AWS SAML sign-in
Hop between AWS consoles fast.
Console Hopper turns the AWS SAML role picker into a searchable launcher, opens every console a ticket needs in one click, and shows you AWS's five-session limit before you run into it.
Open source (MIT)No telemetryNo account
The problem
Signing in to AWS through SAML doesn't scale
If your company reaches AWS through an identity provider and a Landing Zone, you know these three by heart.
Ten console tabs that all look the same
Every AWS console tab has the same icon and a near-identical title. Which one is production?
Env-coloured tab icons, the account name in every title, and tab groups.
"Session limit reached"
AWS allows five console sessions per browser, and only tells you once you're already stuck.
A live counter, and a list of sessions to sign out before you hit the wall.
What you get
Everything between your IdP and the right console
Console Hopper takes over the AWS role picker and the console tabs it opens. Nothing else in your browser changes.
Find any role in a keystroke
Filter by organisation, environment, account type, role name or your own tags. Every filter row stays on one line, and you order the chips by dragging.
Search matches account names, ids and roles, ignores separators (test 123 finds test123), and takes scoped terms:
env:prod tag:pci -role:admin
3 matches
- Star favourites, and Recent tracks itself
- Save a search as a shortcut, or make it your Start View
- Rename accounts so the list reads the way your team talks
Open a ticket's consoles in one click
Launch Sets save the console tabs a piece of work needs under a name, usually the ticket id. Each tab keeps its own role, landing service and region, and one role can have several tabs.
- Save one from a search, or record the console tabs you already have open
- The whole set opens next to the role picker, grouped like any sign-in
- Roles you're already signed in to open in their live session
- One confirmation covers sensitive roles for the whole set
Always know how many sessions you have left
AWS allows five console sessions per browser profile. A counter in the role picker turns amber with one slot left and red when full. Open it to see every session's account, role, region, tab group, age, time left and open tabs.
- Sign out any session, or every idle one, to free a slot; its tabs close with it
- At five of five, a sign-in, jump or Launch Set asks which sessions to sign out first, instead of showing AWS's error page
- A role you're already signed in to shows Open, so you don't sign its tabs out by signing in again
- When AWS ends a session, its tab group turns grey and reads "Ended"
Jump to accounts that aren't in your list
Some accounts you can only reach by assuming a role from a hub account. Set each organisation up once in Jump Profiles, then type the account id you need.
- Signs in to the hub, or reuses your hub session if it's already open
- Opens AWS's Switch Role pre-filled, and picks the hub session when several are open
- Lands in the region you chose, not whichever one AWS picks
- Save frequent destinations and they appear as ⤳ rows in the main list
1 · Signs in to the hubHub account
888899990000 · Hub2 · Assumes the roleSwitch Role
pre-filled, one click3 · You land in333344445555
eu-central-1 · "INC-0419 triage"An optional session label becomes the new tab's title, and recent jumps are one click away.
Console tabs you can tell apart
Every console tab Console Hopper opens gets an env-coloured icon and the account name at the front of its title, so ten open consoles stay readable at a glance.
- Group tabs by role, by organisation, or under a ticket tag, using Chrome's own tab groups
- Tabs stay in their region: open IAM from a Frankfurt tab, go back to EC2, and you're still in Frankfurt
- Changing region from AWS's own menu still works; the tab follows you
And the small things
The clicks you stop making
Deep-link into a service
Pick EC2, S3, IAM or your own entry before signing in, and land in that console instead of the home page.
Region per sign-in
Each row has a region menu that remembers your last pick for that role.
Tag roles
Label an account and role with pci, prod-network or a ticket number, inline with autocomplete.
Keyboard first
/ or ⌘K to search, ↑↓ to move, Enter to sign in, ⌘+Enter for a new tab.
Sensitive sign-in check
A confirmation before signing in to admin roles or the account types you choose.
Copy the account id
Click the account id on any row to copy all twelve digits.
Share your setup
Export your settings as JSON and a teammate imports them. One person sets it up, and the whole team has it.
Clear AWS sessions
One click signs you out of every AWS console and keeps your console settings.
Light, dark or auto
Follows your system theme, with a compact mode for long lists.
At a glance
The same morning, with and without
Everyday AWS console chores, done on the plain sign-in page and done with Console Hopper.
| You want to… | AWS sign-in page alone |  With Console Hopper |
|---|---|---|
| Find one role among hundreds | Scroll the list and read every account name | Type a few letters, or click a filter chip |
| Open the four consoles a ticket needs | Four trips through the role picker, then find each service and region | One click on the ticket's Launch Set |
| Land in the right service and region | Start on the console home page and navigate from there | Pick both on the row before you sign in |
| Know how many sessions you have left | Find out from AWS's "Session limit reached" page | A counter, with sign-out right in the picker |
| Reach an account through a hub | Sign in to the hub, open Switch Role, type the account and role | Type the account id, then one click on the pre-filled Switch Role |
| Tell production tabs from test | Open the account menu in each tab to check | Coloured tab icons and the account name in every title |
| Stay in the region you work in | Global consoles like IAM send the next tab to your default Region | Each tab keeps its own region |
Who it's for
Made for people with too many AWS accounts
If you sign in to AWS through SAML more than a few times a day, it's for you.
You run the Landing Zone
Dozens or hundreds of accounts across organisations and environments. Filter by organisation, environment and account type, tag roles by team, and give everyone the same setup as one JSON file.
You hop between organisations
Several organisations' accounts in a single day. Rename accounts to names you recognise, group tabs by organisation, and reach accounts behind a hub with Jump Profiles.
You need the right console now
Seconds matter when something breaks. Keep a Launch Set per runbook, open every console it needs in one click, and always see which tab is production.
Get started
Running in two minutes
No account and no server. Your settings live in your browser.
-
Add to Chrome
Install Console Hopper from the Chrome Web Store. It's free.
-
Sign in as usual
Go through your identity provider. The AWS role picker you land on is now Console Hopper.
-
Turn on multi-session
In any AWS console tab, choose your account name at the top right, then Turn on multi-session support. The session features need it.
-
Optional: start from a template
Import the Landing Zone sample, or a teammate's exported settings.
Power-user reference
Search, shortcuts and jump profiles
Everything you can type into Console Hopper, on one page.
Search syntax
Search ignores separators, so test 123 finds test123. Focus the box for click-to-insert suggestions and a live match count.
vpc | A bare word matches account name, id, role and tags |
role:admin | Search one field: tag: role: name: id: account: env: type: org: |
env:prod tag:pci | A space means and |
env:prod,test | A comma means or |
-role:admin | A leading minus excludes |
"prod network" | Quotes match the exact phrase |
is:jump | Only your saved jump destinations |
Keyboard
| / or ⌘K | Search |
| ↑ ↓ | Move through roles |
| Enter | Sign in to the selected role |
| ⌘Enter | Sign in, in a new tab |
| ⌥ + arrows | Walk the search suggestions |
| Esc | Close, deselect, then clear every filter |
On Windows and Linux, use Ctrl for ⌘ and Alt for ⌥. ⌘-click or middle-click on any role also opens it in a new tab.
Jump Profiles
One line per organisation, under Jump Profiles in the side menu: name, hub account, the role to assume, and an optional region. Add /HubRole to the hub account when you have more than one role there.
Acme Prod | 111111111111/HubRole | OrgAdmin | eu-central-1
Acme Dev | 222222222222 | OrgAdminThe hub role has to be in your role list, and the destination role has to trust it already. Console Hopper doesn't create roles or change trust policies. AWS caps role-chained sessions at one hour.
Every feature and setting is described in the README on GitHub.
Privacy
Nothing leaves your browser
Console Hopper has no server to send anything to. It runs only on AWS sign-in and console pages, and the only requests it makes go to AWS itself.
The code is open source, so you don't have to take our word for it.
- No telemetry, analytics or error reportingNo third-party requests, no remote code, no tracking of any kind.
- Runs only on
*.aws.amazon.comThe SAML sign-in page and AWS console tabs. No access to any other site. - Talks only to AWSTo list your console sessions and to sign one out when you ask, using AWS's own endpoints, exactly as the console does.
- Never reads your cookiesClear AWS Sessions deletes AWS sign-in cookies. Nothing reads or sends their contents.
- Your SAML response goes only to AWSOnly Launch Sets touch it: one single-use copy per new tab, held in memory and posted only to AWS's sign-in endpoint. A copy nobody takes is discarded after five minutes.
FAQ
Questions
Which AWS sign-in does it work with?
The AWS SAML sign-in page, which is the role picker at signin.aws.amazon.com/saml that your identity provider (Okta, Microsoft Entra ID, ADFS, Ping and others) sends you to. It doesn't change the IAM Identity Center access portal.
Why do I need AWS multi-session support?
Without it, AWS holds one console session at a time and each sign-in replaces the last, so there's nothing for the session counter, Open or multi-role Launch Sets to work with. AWS leaves it off until you turn it on: choose your account name at the top right of any console tab, then Turn on multi-session support. While it's off, Console Hopper's counter says so.
Can my whole team use the same setup?
Yes. Configure your organisations, environments, tags and jump profiles once, use Export Settings to copy them as JSON, and teammates paste it into Import Settings. Nothing is hard-coded to any company.
Can our IT team allow it on managed Chrome?
Yes. It's published on the Chrome Web Store, so it can be added to your organisation's extension allow-list by its id: cadmkfcpkklbeangcbkckpniooaedcpp. It asks only for storage, tabs, tabGroups, cookies and access to aws.amazon.com and its subdomains.
Does it work in Edge, Brave or other browsers?
It's built and tested for Google Chrome. Other Chromium browsers that install extensions from the Chrome Web Store may work, but they aren't tested. There's no Firefox version.
Do my settings follow me to another computer?
No. Settings stay in this Chrome profile's local extension storage and aren't synced anywhere. To move them, use Export Settings on one computer and Import Settings on the other.
What does a jump need on the AWS side?
The hub role has to be in your role list, and the role you jump to has to trust it already. Console Hopper only fills in AWS's own Switch Role form; it doesn't create roles or change trust policies. AWS caps role-chained sessions at one hour.
Is it really free?
Yes. It's open source under the MIT licence, with no account, no paid tier and no ads. Issues and pull requests are welcome on GitHub.
Is this made by AWS?
No. Console Hopper is an independent project and isn't affiliated with or endorsed by Amazon Web Services.
Stop scrolling the role list.
Install Console Hopper, sign in through your identity provider as usual, and the role picker is a launcher from then on.