Orthanc

One-click AWS SSO login and console access

Orthanc reads the AWS SSO profiles you already have in ~/.aws/config and puts them in your browser toolbar. Click a profile, land in the AWS Console signed in to that account and role. Expired session? Orthanc signs you in first, then opens the console. REQUIRES THE FREE COMPANION APP FOR macOS This extension does nothing on its own. It talks to the Orthanc app on your Mac, which is what reads your config and performs the sign-in. Get it here: https://stormacq.net/orthanc/ (macOS 26 or later) WHAT IT DOES • Lists every SSO profile from ~/.aws/config — no accounts to create, nothing to import, no setup wizard. • Shows session state per profile: a lit dot means the session is active, unlit means expired. • Opens the AWS Console for the profile you pick, in the account and role that profile names. • Signs you in when needed, then continues to the console — one click, not two steps. • Works with the AWS Console's multi-session support, so prod and staging can sit in adjacent tabs. • Star the profiles you actually use. Twelve in your config, two you touch daily: the Favourites tab shows only those. Stars live on your Mac, so Chrome, Firefox, and Safari all see the same list. WHY INSTALL IT Without it: run aws sso login, find the Identity Center portal bookmark, locate the right account in the list, pick the right role, wait for the redirect — and it opens in a new tab, never the one you already had. With twelve profiles and three SSO sessions, that ritual repeats all day, and the token expires exactly when you are mid-incident. Orthanc collapses it to one click. It also stays out of the way of your terminal. Tokens are cached in ~/.aws/sso/cache/ in the AWS CLI's own format, so a session started in Orthanc is picked up by aws commands in your shell — and a session started with aws sso login shows as active in the popup. WHAT IT NEVER SEES The extension never receives an AWS token or credential. Those stay in the native app on your Mac; the only thing handed to the browser is profile names, session status, and a final one-time sign-in URL to open in a tab. One permission: nativeMessaging. It cannot read page content, browsing history, or anything you type. There is no server in the login path — the app talks directly to AWS's own SSO OIDC and federation endpoints from your Mac. No accounts, no analytics SDKs, no tracking, no identifier of any kind. PRICING Two profiles are free forever — no trial, no clock, no account. You choose which two by starring them, and you can change your mind at any time. Unlimited profiles is a one-time $17.99 / €14.99 purchase in the app; there is no subscription. The extension itself is free. REQUIREMENTS • macOS 26 or later, with the free Orthanc companion app installed. • AWS IAM Identity Center (SSO) configured, and at least one SSO profile in ~/.aws/config. Profiles using static access keys are not shown — SSO only. • Works in Chrome and other Chromium browsers (Edge, Brave, Arc, Vivaldi, Opera).