diff --git a/pkgs/tools/admin/aws-sso-cli/default.nix b/pkgs/tools/admin/aws-sso-cli/default.nix
new file mode 100644
index 00000000000..96ee8959dba
--- /dev/null
+++ b/pkgs/tools/admin/aws-sso-cli/default.nix
@@ -0,0 +1,25 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+  buildGoModule rec {
+    pname = "aws-sso-cli";
+    version = "1.9.2";
+
+    src = fetchFromGitHub {
+      owner = "synfinatic";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "9/dZfRmFAyE5NEMmuiVsRvwgqQrTNhXkTR9N0d3zgfk=";
+    };
+    vendorSha256 = "BlSCLvlrKiubMtfFSZ5ppMmL2ZhJcBXxJfeRgMADYB4=";
+
+    postInstall = ''
+      mv $out/bin/cmd $out/bin/aws-sso
+    '';
+
+    meta = with lib; {
+      homepage = "https://github.com/synfinatic/aws-sso-cli";
+      description = "AWS SSO CLI is a secure replacement for using the aws configure sso wizard";
+      license = licenses.gpl3Plus;
+      maintainers = with maintainers; [ devusb ];
+      mainProgram = "aws-sso";
+    };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a2c3b14d281..1047a1add01 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1886,6 +1886,8 @@ with pkgs;
 
   aws-sam-cli = callPackage ../development/tools/aws-sam-cli { };
 
+  aws-sso-cli = callPackage ../tools/admin/aws-sso-cli { };
+
   aws-vault = callPackage ../tools/admin/aws-vault { };
 
   aws-workspaces = callPackage ../applications/networking/remote/aws-workspaces { };