orthanc
Your ~/.aws/config, one click from the console.
Orthanc reads your SSO and assume-role profiles and puts them in your browser toolbar, in Chrome, Firefox, and Safari. Click a profile, land in the AWS Console signed in to that account and role. Session expired? It signs you back in and keeps going.
Mac App Store Coming soon
- Runs in Safari
- Sandboxed, updates via the App Store
- Payment handled by Apple
Direct download
- Runs in Chrome, Firefox, and Safari
- Notarized by Apple, you update it yourself
- Payment handled by Stripe
.dmg
Free for 2 profiles · $17.99 / €14.99 one-time for unlimited · no subscription
[profile podcast] sso_session = acme sso_account_id = 226945380156 sso_role_name = AdministratorAccess region = eu-central-1 [profile pro] sso_session = acme sso_account_id = 486652066693 sso_role_name = AdministratorAccess region = eu-central-1 [profile audit] role_arn = arn:aws:iam::314159265358:role/Auditor source_profile = pro region = eu-central-1
You know this loop.
Great, you're logged in. Now where's the Console? Bookmark the Identity Center portal URL, find the right account in that list, pick the right role, wait for the redirect. And it opens in a new tab — never the one you already had open.
Twelve profiles, three SSO sessions, and a token that expires right when you're mid-incident. Orthanc collapses the whole ritual into one click on the profile you want.
Interops with the AWS CLI
Tokens are cached in ~/.aws/sso/cache/ in the AWS CLI's own format. Sign in with Orthanc and your terminal's aws commands just work. It goes the other way too.
Multiple sessions, side by side
Open the console for several accounts at once. Orthanc works with the AWS Console's multi-session support, so prod and staging can sit in adjacent tabs.
Session status at a glance
Every profile shows a lit or unlit dot: active or expired. Click through on an expired one and Orthanc triggers the login flow first, then opens the console.
Star the ones you actually use
Twelve profiles in your config, two you touch daily. Star those and the Favourites tab shows only them. Stars live on your Mac, not in a cloud account, so Chrome, Firefox, and Safari all see the same list.
Assume-role profiles
Not just SSO. Roles you assume, too.
Plenty of profiles reach an account by assuming a role from another one, not by a direct SSO login. Orthanc opens those the same way: give a profile a role_arn and a source_profile, and it shows up in the popup like any other, one click from the console.
Role chaining, resolved for you
Orthanc follows the source_profile chain, signs in at the SSO profile at the base of it, then assumes the role in the target account. You click once; it walks the chain.
The account and role, read from the ARN
An assume-role profile has no sso_account_id, so Orthanc reads the account and role name straight out of the role_arn and shows them in the popup, exactly like an SSO profile.
Static access keys, credential_source, and mfa_serial profiles aren't shown, by design — Orthanc leans on short-lived credentials and would rather not nudge you toward the longer-lived kind.
Three steps, then it disappears into your toolbar.
-
Install the app
Download Orthanc and drag it to Applications. It reads the SSO profiles you already have in
~/.aws/config. No accounts, no setup wizard, no importing. -
Get the extension
Add Orthanc to Chrome or Firefox from their stores, or enable the bundled Safari extension. The app wires up the connection for you on first launch.
-
One click to the console
Open the popup, pick a profile, click Open console. Orthanc handles sign-in if needed and opens the AWS Console for that account and role.
Works where you work.
One extension codebase, three stores. The Chrome build runs in every Chromium-based browser.
- Chrome
- Firefox
- Safari
- Brave
- Arc
- Edge
- + other Chromium browsers
Get the Firefox add-on ↗ Chrome Web Store listing is in review. Safari extension ships inside the Mac app.
Credentials never leave your Mac.
Tokens never reach the browser. They stay in the native app on your Mac, in the AWS CLI's own cache; the only thing handed to the extension is a one-time sign-in URL.
- No server in the login path. The app talks directly to AWS's own endpoints (SSO OIDC and federation) from your Mac. We can't see your accounts, sessions, or traffic. There's nothing in between.
- The extension never sees a token. It receives only profile names, session status, and the final one-time-use federated sign-in URL to open in a tab.
- One permission:
nativeMessaging. The extension can't read page content, browsing history, or anything you type. It exists to talk to the app, nothing else. - No accounts, no analytics SDKs, no tracking. There's an optional, anonymous launch ping (a few booleans and version numbers, no identifiers) and you can turn it off in Settings.
No device ID, no account, no identifier of any kind. The full story: privacy policy.
Free for two profiles. Buy it once for the rest.
Orthanc runs entirely on your Mac. There's no service to rent, so there's no subscription to carry. And no trial to run out: two profiles stay free forever.
$17.99 / €14.99 one-time
- Free forever with 2 profiles: no trial, no clock, no account. Star the two you use and they work indefinitely
- $17.99 / €14.99 unlocks unlimited profiles: one purchase, yours for good, no subscription
- Nothing expires: there's no day 31, and the free tier doesn't degrade over time
Direct purchases are handled by Stripe — your statement will read LINK.COM* Orthanc.
Questions you'd ask before installing.
Why does the extension need a companion app?
Browser extensions can't read ~/.aws/config or perform the SSO device flow safely, and they shouldn't hold your tokens. The native macOS app does all of that locally and hands the extension only the final one-time sign-in URL. That split is the security model, not an inconvenience.
Which profiles does it work with?
SSO profiles and assume-role profiles. Orthanc is built around AWS IAM Identity Center sessions and temporary credentials: a profile that logs in through SSO, or one that reaches an account by assuming a role (role_arn plus source_profile) from an SSO profile.
Profiles using long-lived aws_access_key_id in ~/.aws/credentials, and those using credential_source or mfa_serial, aren't shown.
Can it open profiles that assume a role?
Yes. Give a profile a role_arn and a source_profile pointing at an SSO profile, and Orthanc lists it in the popup like any other. Click it and Orthanc signs in at the source profile, assumes the role, and opens the console for the target account. It follows a chain of source_profiles if you have one.
The target account and role name are read out of the role_arn, so an assume-role profile shows the same account · role line as an SSO one, even though it has no sso_account_id of its own.
Will it fight with my AWS CLI sessions?
The opposite: Orthanc caches tokens in ~/.aws/sso/cache/ using the AWS CLI's format. A session started in Orthanc is picked up by aws in your terminal, and a session started with aws sso login shows up as active in the popup.
What do I need to get started?
macOS 26 or later, an AWS account with IAM Identity Center (SSO) configured, and at least one SSO profile in ~/.aws/config. New to this? The AWS CLI's aws configure sso guide walks you through it.
What exactly is free?
Two profiles, forever. You pick which two by starring them in the popup, and you can change your mind at any time. Those two work completely: sign in, session status, one-click console. There's no trial to expire and nothing that degrades over time.
Your other profiles are still listed, with a lock instead of a button. Unlocking is a one-time $17.99 / €14.99 purchase and it lifts the limit for good.
I have more than two profiles. Can I still try it properly?
Yes. Two live profiles is a real workflow, not a demo, and there's no time limit on it, so you can use Orthanc for as long as you like before deciding. If you juggle client or environment accounts daily, you'll hit the limit quickly, which is rather the point: that's the case the purchase is priced for.
Can I open multiple accounts in the console at once?
Yes. With the AWS Console's multi-session support enabled, launching a second profile opens it alongside the first instead of signing you out.
Why the name?
Inside AWS, employees jump between accounts with an internal tool called Isengard, famously the thing Amazonians miss most when they leave. I left AWS, missed it immediately, and decided to build my own.
Isengard is Saruman's fortress. Orthanc is the tower that stands at its center: older than the wizard who occupied it, and unbreakable. It felt right for a tool whose one job is opening the way into your AWS accounts.