If you're using an external AWS account in AWS SSO, there is no way for you to retrieve the CLI credentials for the role. The workaround suggested by AWS is to use AWS CloudShell.
This Credential Helper extension allows you to retrieve the CLI credentials by passing the SAML Assertion to AWS Security Token Service.
To use this extension:
1. Click on the external AWS account you wish to log into
2. Once the console opens, click on the extension and the popup will appear
3. Your credentials will be available there for you to copy
4. Copy the credentials to your local AWS credentials file
5. Use the AWS CLI from your local machine
Note: This extension does not collect any data. The credentials are available to view only once and are deleted once the popup is closed.
