# Authenticate AWS CLI with SSO

AWS CLI work often stops when an SSO session expires. This skill guides a safe SSO login flow for a selected profile and confirms the session is ready.

## Install

```bash
npx skillstore add daisuke897/aws-sso-login
```

## Metadata

- Status: approved
- Slug: daisuke897-aws-sso-login
- Skillstore revision: r1
- Version status: missing
- Tree hash: 04d98d745fa3ebbf604ac7959f56cc4c27878990397bda02c9185a7b87606fc9
- Author: Daisuke897
- GitHub username: Daisuke897
- License: MIT
- Repository: https://github.com/Daisuke897/dotfiles/tree/main/.github/skills/aws-sso-login
- Ref: 7db9b9f06e0ab79c575b58bc48c4d8dc9849f424
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/daisuke897-aws-sso-login
- Manifest: https://skillstore.pages.dev/api/skills/daisuke897-aws-sso-login/manifest

## Capabilities

- Prompts for the AWS CLI profile when the project does not define one.
- Runs the standard AWS SSO login command for the selected profile.
- Supports browser-based authentication and headless no-browser flows.
- Explains how to verify the authenticated identity after login.
- Prepares AWS CLI access before follow-up operations that require SSO.

## Use Cases

- Renew an expired AWS CLI session: Re-authenticate before running deployment, infrastructure, or diagnostic commands that depend on AWS CLI access.
- Prepare a project-specific AWS profile: Use the documented project profile so cloud commands run against the intended account and permission set.
- Authenticate before assuming roles: Complete SSO login before using later role-assumption workflows that require an active source profile.

## Prompt Templates

### Log in with the default profile

```
Use the aws-sso-login skill to authenticate with the default AWS SSO profile for this project.
```

### Ask before choosing a profile

```
Use the aws-sso-login skill, but ask me which AWS CLI profile to use if the project does not define one.
```

### Verify the session after login

```
Authenticate with AWS SSO for the project profile, then verify that the AWS CLI identity is available.
```

### Prepare for role assumption

```
Run AWS SSO login for the required source profile so the next role-assumption step can use an active session.
```

## Limitations

- Requires AWS CLI v2 with SSO already configured for the chosen profile.
- Cannot complete browser authentication without user interaction.
- Does not create or repair AWS SSO configuration files.
- Does not grant AWS permissions beyond the selected profile.

## Best Practices

- Confirm the profile name before authentication when the project does not define a default.
- Use least-privilege AWS SSO permission sets for the selected profile.
- Verify the authenticated identity before running account-changing operations.

## Anti Patterns

- Do not guess an AWS profile when multiple accounts are available.
- Do not treat SSO login as permission to run destructive cloud commands.
- Do not copy SSO cache files or AWS configuration into shared logs.

## Security Audit

- Audited at: 2026-07-09T01:32:09.607\+00:00
- Summary: The static findings are Markdown formatting, documented AWS CLI examples, and standard AWS SSO configuration references. No prompt injection, credential exfiltration, hidden file access, or malicious intent was found in SKILL.md.

## Stats

- Views: 183
- Downloads: 6
- Favorites: 0
- Popularity score: 0