new aws sso workflow changes

[FernandoMiguel]

• I am using the latest release of AWS Vault
• I have provided my .aws/config (redacted if necessary)
• I have provided the debug output using aws-vault --debug (redacted if necessary)

aws-vault v7.2.0 (from brew)

[profile dev]
sso_start_url = https://XXXX.awsapps.com/start
sso_region = us-east-1
sso_account_id = XXXXX
sso_role_name = AdministratorAccess
region = us-east-1

$ aws-vault login --debug dev
2025/01/08 11:05:47 aws-vault v7.2.0
2025/01/08 11:05:47 Using prompt driver: terminal
2025/01/08 11:05:47 [keyring] Considering backends: [keychain]
2025/01/08 11:05:47 Loading config file /Users/fernando/.aws/config
2025/01/08 11:05:47 Parsing config file /Users/fernando/.aws/config
2025/01/08 11:05:47 [keyring] Querying keychain for service="aws-vault", keychain="aws-vault.keychain"
2025/01/08 11:05:47 [keyring] Found 0 results
2025/01/08 11:05:47 profile ea-dev-legacy: using SSO role credentials
2025/01/08 11:05:47 [keyring] Querying keychain for service="aws-vault", keychain="aws-vault.keychain"
2025/01/08 11:05:47 [keyring] Found 0 results
2025/01/08 11:05:47 [keyring] Querying keychain for service="aws-vault", keychain="aws-vault.keychain"
2025/01/08 11:05:47 [keyring] Found 0 results
2025/01/08 11:05:47 [keyring] Querying keychain for service="aws-vault", account="sso.GetRoleCredentials,XXX,,xxxx", keychain="aws-vault.keychain"
2025/01/08 11:05:47 [keyring] No results found
2025/01/08 11:05:47 [keyring] Querying keychain for service="aws-vault", account="oidc:https://XXXXX.awsapps.com/start", keychain="aws-vault.keychain"
2025/01/08 11:05:47 [keyring] No results found
2025/01/08 11:05:47 Created new OIDC client (expires at: 2025-04-08 12:05:47 +0100 WEST)
2025/01/08 11:05:47 Created OIDC device code for https://XXXXX.awsapps.com/start (expires in: 600s)
2025/01/08 11:05:47 Opening SSO authorization page in browser
Opening the SSO authorization page in your default browser (use Ctrl-C to abort)
https://XXXXX.awsapps.com/start/#/device?user_code=XXXXXXX

both exec and login no longer work today.
I suspect aws sso workflow has changed.
now, instead of getting valid creds, https://XXXX.awsapps.com/start/ page opens.
reading https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html , seems a new field is required
SSO registration scopes [None]: sso:account:access

[neovatar]

It is working for me, have you tried adding the scope to your profile? @FernandoMiguel

I use it like this:

[sso-session XXXX-sso]
sso_start_url           = https://XXXX.awsapps.com/start
sso_region              = eu-central-1
sso_registration_scopes = sso:account:access

[profile XXXX-backend-integration/Developer]
sso_session    = XXXX-sso
region         = eu-central-1
sso_account_id = XXXXXXXXXXXX
sso_role_name  = Developer

[profile XXXX-backend-integration/Administrator]
sso_session    = XXXX-sso
region         = eu-central-1
sso_account_id = XXXXXXXXXXXX
sso_role_name  = Administrator

[FernandoMiguel]

@neovatar yep.

[default]
region = us-east-1

[sso-session sso]
sso_registration_scopes = sso:account:access
sso_region = us-east-1
sso_start_url = https://XXXXX.awsapps.com/start

[profile parent]
sso_session = sso
sso_account_id = 1234567890
sso_role_name = AdministratorAccess
region = us-east-1

[profile dev]
sso_session = sso
sso_account_id = 34567890123
sso_role_name = AdministratorAccess
region = us-east-1

it opens awsapps.com instead of logging into a role.
if I then click on the CLI URL a 2nd time, it works.
but it's very fustrating

[neovatar]

For me it works like expected:

• takes me through SSO login process the first time, then forwards me to the account/role AWS console
• with a valid session it takes me directly into the account/role AWS console

Also it does not show an URL for me in the CLI to click, but directly opens my browser. Maybe that is where your issue happens?

[FernandoMiguel]

For me it works like expected:

* takes me through SSO login process the first time, then forwards me to the account/role AWS console

* with a valid session it takes me directly into the account/role AWS console

Also it does not show an URL for me in the CLI to click, but directly opens my browser. Maybe that is where your issue happens?

it's not about browser or aws console.
it's about have a CLI role

[FernandoMiguel]

$ aws-vault --debug exec dev --

[neovatar]

The AWS SSO workflow always takes you to the browser for the login process.

Running:

aws-vault exec --debug XXXX-backend-integration/Developer --

runs me through the SSO login as I described above, but instead of opening a AWS console in browser, it opens a subshell with the correct AWS role/permissions. When I have an active session cached in aws-vault it does not open the SSO workflow but directly opens the subshell.

I cannot reproduce your error and just can tell you that I'm using aws-vault with AWS SSO for my CLI work on a daily basis :(

Edit: added my log

❯ aws-vault exec --debug XXXX-backend-integration/Developer
2025/03/19 15:10:15 aws-vault v7.2.0
2025/03/19 15:10:15 Using prompt driver: terminal
2025/03/19 15:10:15 Loading config file /home/tom/.aws/config
2025/03/19 15:10:15 Parsing config file /home/tom/.aws/config
2025/03/19 15:10:15 [keyring] Considering backends: [secret-service]
2025/03/19 15:10:15 Using a session duration of "2h0m0s" from AWS_SESSION_TOKEN_TTL
2025/03/19 15:10:15 profile XXXX-backend-integration/Developer: using SSO role credentials
2025/03/19 15:10:15 Setting subprocess env: AWS_REGION=eu-central-1, AWS_DEFAULT_REGION=eu-central-1
2025/03/19 15:10:15 Created new OIDC client (expires at: 2025-06-17 16:10:15 +0200 CEST)
2025/03/19 15:10:15 Created OIDC device code for https://XXXX.awsapps.com/start (expires in: 600s)
2025/03/19 15:10:15 Opening SSO authorization page in browser
Opening the SSO authorization page in your default browser (use Ctrl-C to abort)
https://XXXX.awsapps.com/start/#/device?user_code=XXXX-XXXX
2025/03/19 15:10:29 Created new OIDC access token for https://XXXX.awsapps.com/start (expires in: 28800s)
2025/03/19 15:10:29 Got credentials ******************** for SSO role Developer (account: XXXXXXXXXXXX), expires in 3h59m58.42996388s
2025/03/19 15:10:29 Setting subprocess env: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
2025/03/19 15:10:29 Setting subprocess env: AWS_SESSION_TOKEN
2025/03/19 15:10:29 Setting subprocess env: AWS_CREDENTIAL_EXPIRATION
2025/03/19 15:10:29 Starting subshell /bin/bash, use `exit` to exit the subshell
2025/03/19 15:10:29 Exec command /bin/bash 
2025/03/19 15:10:29 Found executable /bin/bash