Legacy non-refreshable configuration for Amazon IAM Identity Center (successor to Amazon Single Sign-On)

To enable an IAM Identity Center enabled profile to your Amazon CLI

1. Run the aws configure sso command and provide your IAM Identity Center start URL and the Amazon Region that hosts the Identity Center directory.

   $ aws configure sso
   SSO session name (Recommended):
   SSO start URL [None]: https://my-sso-portal.awsapps.com/start
   SSO region [None]:us-east-1

2. The Amazon CLI attempts to open your default browser and begin the login process for your IAM Identity Center account.

   SSO authorization page has automatically been opened in your default browser.
   Follow the instructions in the browser to complete this authorization request.

   If the Amazon CLI cannot open the browser, the following message appears with instructions on how to manually start the login process.

   Using a browser, open the following URL:
    
   https://device.sso.us-west-2.amazonaws.com/
   
   and enter the following code:
   QCFK-N451

   IAM Identity Center uses the code to associate the IAM Identity Center session with your current Amazon CLI session. The IAM Identity Center browser page prompts you to sign in with your IAM Identity Center credentials. This gives permissions to the Amazon CLI to retrieve and display the Amazon accounts and roles that you are authorized to use with IAM Identity Center.

3. Next, the Amazon CLI displays the Amazon accounts available for you to use. If you are authorized to use only one account, the Amazon CLI selects that account for you automatically and skips the prompt. The Amazon accounts that are available for you to use are determined by your user configuration in IAM Identity Center.

   There are 2 Amazon accounts available to you.
   > DeveloperAccount, developer-account-admin@example.com (123456789011) 
     ProductionAccount, production-account-admin@example.com (123456789022)

   Use the arrow keys to select the account you want to use with this profile. The ">" character on the left points to the current choice. Press ENTER to make your selection.

4. Next, the Amazon CLI confirms your account choice, and displays the IAM roles that are available to you in the selected account. If the selected account lists only one role, the Amazon CLI selects that role for you automatically and skips the prompt. The roles that are available for you to use are determined by your user configuration in IAM Identity Center.

   Using the account ID 123456789011
   There are 2 roles available to you.
   > ReadOnly
     FullAccess

   Use the arrow keys to select the IAM role you want to use with this profile and press <ENTER>.

5. The Amazon CLI confirms your role selection.

   Using the role name "ReadOnly"

6. Finish the configuration of your profile by specifying the default output format, the default Amazon Web Services Region to send commands to, and providing a name for the profile so you can reference this profile from among all those defined on the local computer. In the following example, the user enters a default Region, default output format, and the name of the profile. You can alternatively press <ENTER> to select any default values that are shown between the square brackets. The suggested profile name is the account ID number followed by an underscore followed by the role name.

   CLI default client Region [None]: us-west-2<ENTER>
   CLI default output format [None]: json<ENTER>
   CLI profile name [123456789011_ReadOnly]: my-dev-profile<ENTER>

   Note

   If you specify default as the profile name, this profile becomes the one used whenever you run an Amazon CLI command and do not specify a profile name.

7. A final message describes the completed profile configuration.

   To use this profile, specify the profile name using --profile, as shown:

   aws s3 ls --profile my-dev-profile

8. The previous example entries would result in a named profile in ~/.aws/config that looks like the following example.

   [profile my-dev-profile]
   sso_start_url = https://my-sso-portal.awsapps.com/start
   sso_region = us-east-1
   sso_account_id = 123456789011
   sso_role_name = readOnly
   region = us-west-2
   output = json

   At this point, you have a profile that you can use to request temporary credentials. You must use the aws sso login command to actually request and retrieve the temporary credentials needed to run commands. For instructions, see Using an IAM Identity Center enabled named profile .