SDK authentication with Amazon - Amazon SDK for PHP
Start an Amazon access portal sessionLearn more about authentication
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

SDK authentication with Amazon

You must establish how your code authenticates with Amazon when developing with Amazon Web Services services. You can configure programmatic access to Amazon resources in different ways depending on the environment and the Amazon access available to you.

To choose your method of authentication and configure it for the SDK, see Authentication and access in the Amazon SDKs and Tools Reference Guide.

We recommend that new users who are developing locally and are not given a method of authentication by their employer should set up Amazon IAM Identity Center. This method includes installing the Amazon CLI for ease of configuration and for regularly signing in to the Amazon access portal. If you choose this method, your environment should contain the following elements after you complete the procedure for IAM Identity Center authentication in the Amazon SDKs and Tools Reference Guide:

  • The Amazon CLI, which you use to start an Amazon access portal session before you run your application.

  • A shared Amazonconfig file that has a [default] profile with a set of configuration values that can be referenced by the SDK. To find the location of this file, see Location of the shared files in the Amazon SDKs and Tools Reference Guide.

  • The shared config file contains the region setting. This sets the default Amazon Web Services Region that the SDK uses for requests. This Region is used for SDK service requests that aren't explicitly configured with a region property.

  • The SDK uses the profile's SSO token provider configuration to acquire credentials before sending requests to Amazon. The sso_role_name value, which is an IAM role connected to an IAM Identity Center permission set, allows access to the Amazon Web Services services used in your application.

    The following sample config file shows a default profile set up with SSO token provider configuration. The profile's sso_session setting refers to the named sso-session section. The sso-session section contains settings to initiate an Amazon access portal session.

    [default]
sso_session = my-sso
sso_account_id = 111122223333
sso_role_name = SampleRole
region = us-east-1
output = json

[sso-session my-sso]
sso_region = us-east-1
sso_start_url = https://provided-domain.awsapps.com/start
sso_registration_scopes = sso:account:access

The Amazon SDK for PHP does not need additional packages (such as SSO and SSOOIDC) to be added to your application to use IAM Identity Center authentication.

Start an Amazon access portal session

Before running an application that accesses Amazon Web Services services, you need an active Amazon access portal session for the SDK to use IAM Identity Center authentication to resolve credentials. Depending on your configured session lengths, your access will eventually expire and the SDK will encounter an authentication error. To sign in to the Amazon access portal, run the following command in the Amazon CLI.

aws sso login

If you followed the guidance and have a default profile setup, you do not need to call the command with a --profile option. If your SSO token provider configuration is using a named profile, the command is aws sso login --profile named-profile.

To optionally test if you already have an active session, run the following Amazon CLI command.

aws sts get-caller-identity

If your session is active, the response to this command reports the IAM Identity Center account and permission set configured in the shared config file.

Note

If you already have an active Amazon access portal session and run aws sso login, you will not be required to provide credentials.

The sign-in process might prompt you to allow the Amazon CLI access to your data. Because the Amazon CLI is built on top of the SDK for Python, permission messages might contain variations of the botocore name.

Learn more about authentication