Viasat/alohomora ? reverse-engineered prompt

Build me a Python command line tool that helps people who sign into AWS through SAML get temporary AWS API keys and save them into their local AWS credentials file.

I want it to handle a normal username and password flow, then let the user pick an AWS role, and support MFA with Duo so the user can choose push, phone call, or passcode. It should also let people set common settings in a config file in their home folder, like the IdP URL, username, default auth method, AWS profile name, account and role preferences, and friendly names for AWS accounts.

If possible, add optional browser based login too, so it can open a real browser window, fill in the username, and let the user finish Duo there. Please make the command feel simple to use from terminal, write useful logs, and store the resulting credentials under an AWS profile so they can run aws commands right away. If you need to look up current docs online, go ahead.