aws configure sso: Set Up IAM Identity Center Login

Configure an IAM Identity Center (SSO) profile for interactive CLI login.

aws configure sso sets up a profile backed by IAM Identity Center, then aws sso login opens a browser to authenticate. It is excellent for local developer machines but is interactive, so CI should use OIDC role assumption instead of SSO.

Common flags

--profile NAME - name the SSO-backed profile
--use-device-code - device-code flow for headless environments
aws sso login --profile NAME - the companion command to authenticate
aws sso logout - clear the cached SSO session

Example in CI

SSO is interactive; on a local machine you configure then log in. CI should prefer OIDC roles.

shell

aws configure sso --profile dev
aws sso login --profile dev

Common errors in CI

Error loading SSO Token: Token has expired - run aws sso login again
The SSO session associated with this profile has expired - re-authenticate
Interactive flow blocked in CI - SSO needs a browser; use OIDC role auth on runners instead

Key takeaways

configure sso + sso login give interactive, browser-based CLI auth.
It suits developer laptops, not CI - SSO is interactive by design.
On CI runners, use GitHub OIDC role assumption instead of SSO.