diff --git a/pkgs/tools/admin/aws-google-auth/default.nix b/pkgs/tools/admin/aws-google-auth/default.nix
new file mode 100644
index 000000000000..5d4ba0bfbc8c
--- /dev/null
+++ b/pkgs/tools/admin/aws-google-auth/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, beautifulsoup4
+, boto3
+, configparser
+, keyring
+, keyrings-alt
+, lxml
+, pillow
+, requests
+, six
+, tabulate
+, tzlocal
+, nose
+, mock
+, withU2F ? false, python-u2flib-host
+}:
+
+buildPythonApplication rec {
+  pname = "aws-google-auth";
+  version = "0.0.29";
+
+  # Pypi doesn't ship the tests, so we fetch directly from GitHub
+  # https://github.com/cevoaustralia/aws-google-auth/issues/120
+  src = fetchFromGitHub {
+    owner = "cevoaustralia";
+    repo = "aws-google-auth";
+    rev = version;
+    sha256 = "06dalrwjy1sbc5wvj5ip4h999izlb0j5g6b6f3l5znnsm0vfvfia";
+  };
+
+  propagatedBuildInputs = [ 
+    beautifulsoup4
+    boto3
+    configparser
+    keyring
+    keyrings-alt
+    lxml
+    pillow
+    requests
+    six
+    tabulate
+    tzlocal
+  ] ++ lib.optional withU2F python-u2flib-host;
+  
+  checkInputs = [ 
+    mock
+    nose 
+  ];
+
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  meta = with lib; {
+    description = "Acquire AWS STS (temporary) credentials via Google Apps SAML Single Sign On";
+    homepage = https://github.com/cevoaustralia/aws-google-auth;
+    maintainers = [ maintainers.marsam ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index af34fef8dd9a..e21ab50f0ddf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -611,6 +611,8 @@ with pkgs;
 
   aws-env = callPackage ../tools/admin/aws-env { };
 
+  aws-google-auth = pythonPackages.callPackage ../tools/admin/aws-google-auth { };
+
   aws-okta = callPackage ../tools/security/aws-okta { };
 
   aws-rotate-key = callPackage ../tools/admin/aws-rotate-key { };