[alFReD-NSH]

The point of CloudShell is to easy use AWS CLI without setting it up and setting the credentials, however to use this from your own terminal, it means you have to install software and then configure credentials, well then that would exactly same as installing AWS CLI and configuring it.

[yjftsjthsd-h]

On the flip side: How is installing a browser and authenticating in it any better than installing openssh and/or awscli and authenticating through them?

[Thorrez]

I think it's assumed that everyone already has a browser installed. Also to authenticate through openssh and/or awscli it will likely require some browser interaction, so that would require installing a browser if one isn't installed.

[acdha]

MFA and persistence — especially if you use SSO. If you have credentials sitting around in your home directory they can be harvested from a standard location by malware and people are often very slow to rotate them. In contrast, if you're following Amazon's guidelines your console login will already have MFA and be using short-term credentials.

[yjftsjthsd-h]

awscli directly supports 2fa (https://aws.amazon.com/premiumsupport/knowledge-center/authe... ); I guess having to harvest cookies out of a browser profile is more work, but it seems like a small difference

[acdha]

It supports some MFA (e.g. not U2F / FIDO) and not if you use SSO.

The browser profile is harder to exfiltrate, in part because modern OSes have ways to restrict access to particular processes, but that was also only part of the benefit: the main thing is the duration of the session. Tons of people leave AWS keys sitting around in ~/.aws for ages.

You can setup schemes with STS but not everyone remembers that and with this approach you have a very simple answer: it always uses STS, there's never a file sitting around for someone to accidentally save somewhere they shouldn't, etc.

Nothing here is something you couldn't do on your own — it's just a very easy option with safe defaults.

[joseph]

I think the issue is that web based terminals aren't very usable, as they mess with keybindings and line wrapping, for example. At least that is the case with GCP Cloud Shell. It makes it pretty difficult to use for even basic things like running vi or emacs.

[isaveyou]

Doesnt save link as a PWA make it behave like yet another electron app with regards to key capture?

[ohyeshedid]

You can connect via ssh to a GCP cloudshell instance, you just need to spin it up first.

[the8472]

The problem is that AWS CLI without access to your custom workflows in the form of aliases, scripts and what-not is far less useful.

Or perhaps even entirely useless if you'd normally use it as part of a local build and test process.