The Wayback Machine - https://web.archive.org/web/20231220004742/https://docs.aws.amazon.com/sdkref/latest/guide/access-sso.html
IAM Identity Center authentication - AWS SDKs and Tools
Configure programmatic access using IAM Identity Center

IAM Identity Center authentication

AWS IAM Identity Center is the recommended method of providing AWS credentials when developing on a non-AWS compute service. For example, this would be something like your local development environment. If you are developing on an AWS resource, such as Amazon Elastic Compute Cloud (Amazon EC2) or AWS Cloud9, we recommend getting credentials from that service.

Configure programmatic access using IAM Identity Center

Step 1: Establish access and select appropriate permission set

Choose one of the following methods to access your AWS credentials.

Follow the instructions in Getting started in the AWS IAM Identity Center User Guide. This process enables IAM Identity Center, creates an administrative user, and adds an appropriate least-privilege permission set.

  • For Step 6 – Create a permission set that applies least-privilege permissions. We recommend using the predefined PowerUserAccess permission set, unless your employer has created a custom permission set for this purpose.

Exit the portal and sign in again to see your AWS accounts and options for Administrator or PowerUserAccess. Select PowerUserAccess when working with the SDK. This also helps you find details about programmatic access.

Sign in to AWS through your identity provider’s portal. If your Cloud Administrator has granted you PowerUserAccess (developer) permissions, you see the AWS accounts that you have access to and your permission set. Next to the name of your permission set, you see options to access the accounts manually or programmatically using that permission set.

Custom implementations might result in different experiences, such as different permission set names. If you're not sure which permission set to use, contact your IT team for help.

Sign in to AWS through the AWS access portal. If your Cloud Administrator has granted you PowerUserAccess (developer) permissions, you see the AWS accounts that you have access to and your permission set. Next to the name of your permission set, you see options to access the accounts manually or programmatically using that permission set.

Contact your IT team for help.

Step 2: Configure SDKs and tools to use IAM Identity Center

  1. On your development machine, install the latest AWS CLI. See Installing or updating the latest version of the AWS CLI in the AWS Command Line Interface User Guide. You use the AWS CLI to configure and sign in to the IAM Identity Center access portal.

  2. (Optional) To verify that the AWS CLI is working, open a command prompt and run the aws --version command.

  3. In the AWS access portal, select the permission set you use for development, and select the Command line or programmatic access link.

  4. In the Get credentials dialog box, choose either MacOS and Linux or Windows, depending on your operating system.

  5. Choose the IAM Identity Center credentials method to get the SSO Start URL and SSO Region values that you need for the next step.

  6. Follow the procedure to Configure your profile with the aws configure sso wizard in the AWS CLI by running the aws configure sso command. When prompted, enter the configuration values that you collected in the previous step.

    1. For CLI profile name, we recommend entering default when you are getting started. For information about how to set non-default (named) profiles and their associated environment variable, see Profiles.

    2. The aws configure sso command also signs you in to the IAM Identity Center access portal and begins your access portal session.

    3. Alternatively, you can create this configuration manually. For config file settings, see IAM Identity Center credential provider.

  7. (Optional) In the AWS CLI, confirm the active session identity by running the aws sts get-caller-identity command. The response should show the IAM Identity Center permission set that you configured.

  8. If you are using an AWS SDK, create an application for your SDK in your development environment.

    1. For some SDKs, additional packages such as SSO and SSOOIDC must be added to your application before you can use IAM Identity Center authentication. For details, see your specific SDK.

    2. If you previously configured access to AWS, review your shared AWS credentials file for any AWS access keys. You must remove any static credentials before the SDK or tool will use the IAM Identity Center credentials because of the Credential provider chain precedence.

For a deep dive into how the SDKs and tools use and refresh credentials using this configuration, see Understand IAM Identity Center authentication. Depending on your configured session lengths, your access will eventually expire and the SDK or tool will encounter an authentication error.

To refresh the access portal session again when needed, use the AWS CLI to run the aws sso login command. Use the predefined PowerUserAccess permission set, or whichever permission set you or your employer has created to best apply least-privilege permissions.

You can extend both the IAM Identity Center access portal session duration and the permission set session duration. This lengthens the amount of time that you can run code before you need to manually sign in again with the AWS CLI. For more information, see the following topics in the AWS IAM Identity Center User Guide: