Console Hopper Creds

Companion extension for Console Hopper

Your sign-in, as CLI keys.

Console Hopper Creds adds a Keys button to every role on the AWS SAML sign-in page. One click trades the page's own sign-in for temporary credentials, ready to paste as environment variables, a credentials profile or whatever your tools read.

Add to Chrome — it's free View the source

Open source (MIT)Nothing storedTalks only to AWS

The Keys dialog for acme-prod-audit, role Billing, open over Console Hopper's role picker: the account id, an expiry 60 minutes out and the session name; tabs for macOS and Linux, Windows, PowerShell and fish; environment variables, a profile for the AWS credentials file and the individual values, each with a Copy button and the secrets masked; and Download credentials file, Settings and Done buttons.
Why a separate extension

Keys are opt-in, by design

Plenty of organisations don't allow turning a console sign-in into CLI keys. Console Hopper is used in those places too, so the keys live in an extension of their own.

Console Hopper stays as it is

It never turns a sign-in into keys

Console Hopper keeps its promise not to read credentials. Creds adds its buttons to the page Console Hopper builds, and the two never send each other messages.

Your organisation decides

Allow it, block it, or switch it off

Creds has its own extension id, so an organisation that must not have it blocks that id and keeps Console Hopper. Where it is installed, Chrome policy can still switch it off.

Only what you already have

No new access

Keys come only for roles your identity provider already lists, for no longer than each role allows. The AWS CLI accepts the same SAML response; stopping key issuance is a job for AWS-side policy.

What you get

From the role picker to your terminal in one click

Creds builds on the role picker Console Hopper draws, so it needs Console Hopper 1.9.0 or later.

A Keys button on every role

Keys sits next to Sign In on each role row. Click it, and AWS's token service returns that role's temporary keys, shown in a dialog on the same page.

  • Keys for all roles in the right-hand column asks for every role at once
  • It follows Console Hopper's filters and search: narrow the list and it asks only for the roles shown
  • Creds Settings sits at the end of Console Hopper's side menu
Console Hopper's role picker with a Keys button beside every Sign In button, and a Keys for all roles button for 49 roles in the right-hand column.

Every format you'd paste

Environment variables for four shells, a profile for ~/.aws/credentials and the individual values, side by side. Pick your shell and copy.

More formats are one click further:

  • aws configure set
  • credential_process JSON
  • .env
  • Docker
  • Terraform
  • boto3
  • JavaScript, Go, Java and .NET SDKs
  • AWS Tools for PowerShell
  • 1Password
  • Raw JSON
  • Your own templates

Secrets stay masked until you reveal them, and the expiry line lets the CLI stop before AWS does.

# Option 1: environment variables
export AWS_ACCESS_KEY_ID="ASIAIOSFODNN7EXAMPLE"
export AWS_SECRET_ACCESS_KEY="••••••••••••••••••••"
export AWS_SESSION_TOKEN="••••••••••…(860 chars)"
export AWS_CREDENTIAL_EXPIRATION="2026-10-19T22:08:06Z"
export AWS_REGION="eu-central-1"

# Option 2: profile for ~/.aws/credentials
[acme-prod-audit-Billing]
aws_access_key_id = ASIAIOSFODNN7EXAMPLE
aws_secret_access_key = ••••••••••••••••••••
aws_session_token = ••••••••••…(860 chars)

Every role's keys, in one file

Keys for all roles asks AWS for every role the picker shows, in parallel, and lists each one with its status and expiry.

  • Copy any one row as environment variables or a profile
  • Download one credentials file with a profile per role, or a config file
  • Profile names follow your pattern, {account}-{role} by default
The Keys for all roles dialog: one sign-in, 49 roles, 49 calls to AWS's token service in parallel, all succeeded. A table lists each account, id, role, status, expiry and profile name with copy buttons, above an export menu set to a credentials file with 49 profiles.

Straight from the page to AWS

The sign-in page already holds the SAML response your identity provider issued. When you click Keys, Creds sends it, with the role you chose, to AWS's token service in the sign-in page's own region, and shows you what comes back.

  • Asks for the session length your identity provider set, or one you choose
  • If a role allows less, it retries at 1 hour, then 15 minutes, and says so
  • AWS accepts a sign-in page for about five minutes; after that, Keys greys out until you sign in again
  • Works with regional, GovCloud and China sign-in pages
Settings and details

Set it once, then forget it

Open Creds Settings from the end of Console Hopper's side menu, or from any Keys dialog.

Session length

Follow your identity provider's SessionDuration, or pick a fixed length from 15 minutes to 12 hours.

Profile names

A pattern built from {account}, {accountId} and {role}; {account}-{role} by default.

Region

For environment variables, profiles and the token service. Left empty, it's the sign-in page's own region.

Your own templates

Any format the built-in list lacks, with placeholders like {{accessKeyId}} and {{sessionToken}}.

Matches Console Hopper

The dialogs follow Console Hopper's own light or dark switch, not just your system theme.

Traceable in CloudTrail

The keys carry your sign-in's role session name, so CloudTrail records their calls under it, just as it does a console sign-in.

Privacy

Keys that exist only on screen

Creds runs only on the AWS SAML sign-in page and has no server of its own. The credentials it fetches are shown to you and are gone when the dialog closes.

The code is open source, so you can check every line.

Read the full privacy policy

  • Runs only on the SAML sign-in pagesignin.aws.amazon.com/saml and its regional hosts. No console pages, no other sites.
  • Talks only to AWS's token serviceOne AssumeRoleWithSAML request per role you ask for, and only when you click Keys. No telemetry, analytics or update checks.
  • Stores no credentialsKeys are held in memory while the dialog is open. Your settings are kept in Chrome's extension storage; never keys, never the SAML response.
  • Asks for almost nothingOnly the storage permission and the sign-in page itself. No cookies, no tabs, no access to other sites.
For administrators

Keep it off your fleet, or allow it

Allowing Console Hopper never means allowing keys. Creds is a separate install you decide on separately.

Block it

Leave Creds off your extension allow-list, or block its extension id, jfccfpclemghippgnlpdkagfidlkmimm. Console Hopper keeps working exactly as before; Creds is the only part that turns a sign-in into keys.

What actually prevents key issuance is AWS-side policy: role trust policies, STS deny statements and sign-in resource policies. The SAML response passes through the browser either way, and the AWS CLI's assume-role-with-saml accepts it.

Or switch it off by policy

Where Creds is installed, set this in the extension's managed policy (Chrome's 3rdparty policy for its id):

{ "enabled": false }

It then adds nothing to the sign-in page and never contacts AWS.

Get started

Running in two minutes

No account and no server. Your settings live in your browser.

  1. Have Console Hopper

    Creds needs Console Hopper 1.9.0 or later, from the Chrome Web Store.

  2. Add Creds to Chrome

    Install Console Hopper Creds from the Chrome Web Store. It's free.

  3. Sign in as usual

    Go through your identity provider. Every role on the AWS role picker now has a Keys button.

  4. Click Keys

    Use it within about five minutes of signing in; after that, AWS wants a fresh sign-in.

Rather build it yourself? The README on GitHub shows how.

FAQ

Questions

Does it work without Console Hopper?

No. It adds its buttons to the role picker Console Hopper builds, and reads the sign-in expiry Console Hopper marks on the page. Without Console Hopper 1.9.0 or later, it shows a short note instead of the Keys buttons.

Do I need Creds to use Console Hopper?

No. Console Hopper works on its own, and you only need Creds if you want command-line keys from the same sign-in.

How long do the keys last?

As long as your identity provider's SessionDuration asks for, or the length you set, from 15 minutes to 12 hours. A role can allow less; Creds then retries at 1 hour, then 15 minutes, and tells you which length it got.

Why do the Keys buttons grey out?

AWS accepts a SAML sign-in page for only about five minutes after your identity provider issues it. Once that time is up, Console Hopper marks the page as expired and Keys greys out until you sign in again.

Where do the keys go?

Only to your screen, and wherever you paste them. They're held in memory while the dialog is open and discarded when it closes. If you download a credentials file, that copy is yours to look after.

Does it work with IAM Identity Center?

No. Like Console Hopper, it works on the AWS SAML sign-in page your identity provider (Okta, Microsoft Entra ID, ADFS, Ping and others) sends you to. The IAM Identity Center access portal has its own way to get keys.

Can our IT team allow or block it?

Yes. It's published on the Chrome Web Store under its own id, jfccfpclemghippgnlpdkagfidlkmimm, so it goes on an allow-list or block list separately from Console Hopper. To switch it off where it's already installed, see For administrators.

Is this made by AWS?

No. Console Hopper Creds is an independent, open-source project under the MIT licence, and isn't affiliated with or endorsed by Amazon Web Services.

From sign-in to terminal, in one click.

Install Console Hopper, add Creds, and every role on the AWS sign-in page comes with its keys.

Add to Chrome — it's free Star on GitHub