# switch-profile, open-source AWS account switching with SSO

> My open-source CLI for working across many AWS accounts: one keystroke to switch, IAM Identity Center done properly, device-code logins on headless boxes, and a contract AI agents can follow.

- Client: Open source (Cloud developer tools)
- Role: Author and maintainer, Nicolas Dao
- Status: Live. Our products and research
- Capabilities: AWS, Security, Developer tools, Open source
- Web page: https://cloudlesslabs.com/work/switch-profile/

## Outcomes

- Switching between client AWS accounts in one keystroke, many times a day.
- Every account and role in an SSO portal imported in one command, and kept in sync.
- Safe for agents: JSON output, no prompts without a terminal, and an exit code that means "a human must log in".

## The situation

A consultant lives in many AWS accounts at once: each client, each environment, each role. The AWS CLI can do all of it, but switching is slow, setting up SSO for dozens of accounts is tedious, and it's far too easy to run a command against production when you meant staging.

## What I built

An open-source CLI, published on npm. Type `sp` for a searchable list of every account, most used first, or `sp acme prod` to jump straight there. Every switch confirms the real identity, production is flagged in red, and one command imports a whole Identity Center portal. On an SSH box with no browser it switches to a device code by itself and puts the code on my laptop's clipboard. It builds on the official AWS CLI and stores no credentials of its own.

The full verdict, with how it compares to aws-vault, Granted and the others, is in [The Stack](https://cloudlesslabs.com/stack/switch-profile/index.md).

## Why it matters to you

Security in the cloud is mostly about small habits done every day: short-lived credentials instead of keys, knowing which account you're in, never touching production by accident. I built a tool so those habits cost nothing, and it's the same thinking I bring to a client's AWS foundation.

## Built with

- [switch-profile](https://cloudlesslabs.com/stack/switch-profile/index.md): My default in The Stack
- [AWS Organizations + IAM Identity Center](https://cloudlesslabs.com/stack/aws-organizations-identity-center/index.md): My default in The Stack
- AWS CLI
- IAM Identity Center
- Device-code login

## Links

- [switch-profile on GitHub](https://github.com/nicolasdao/switch-profile)

## Related

- [Off a fragile VPS and onto AWS, with almost no downtime](https://cloudlesslabs.com/work/vps-to-aws/index.md): a related project
- [HappySkills, the package manager for AI agent skills](https://cloudlesslabs.com/work/happyskills/index.md): a related project
- [Every project](https://cloudlesslabs.com/work/index.md)
- [How we work](https://cloudlesslabs.com/about/how-we-work/index.md)
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)