How does the AWS CLI obtain credentials for a profile created by `aws configure sso`, and what does running `aws sso login` actually do?

## Two layers of expiry The thing that confuses people about SSO profiles is that there are **two** short-lived artefacts, not one: 1. The **SSO access token**, obtained by signing in through the browser. It represents "this human is authenticated to the portal" and is shared by every profile that names the same `sso-session`. 2. The **role credentials** — an access key ID, secret and session token for one specific account and permission set, obtained by presenting the SSO token. Their lifetime is the permission set's session duration. Signing in once therefore lights up every account you have been assigned, and each profile mints its own role credentials on demand. ## What lands in ~/.aws/config ```ini [sso-session corp] sso_start_url = https://d-9067f2a1b3.awsapps.com/start sso_region = eu-west-1 sso_registration_scopes = sso:account:access [profile prod-admin] sso_session = corp sso_account_id = 111122223333 sso_role_name = AdministratorAccess region = eu-west-1 ``` Note what is *not* there: no access key, no secret, no password. `sso_role_name` is the **permission set name**, not a role ARN — Identity Center resolves it to the provisioned role in that account. Older configurations put `sso_start_url` and `sso_region` directly inside the profile with no `sso-session` block. That legacy form still works, but the session block is the one to write today because it supports token refresh and is shared across profiles. ## What `aws sso login` does It registers the CLI as an OIDC client with the portal, starts an authorisation flow, and opens your browser (or prints a URL and a user code when it cannot). You authenticate against whatever the identity source is — including the MFA that source enforces — and approve the request. The CLI polls until the flow completes, then writes a JSON blob containing the access token and its expiry into `~/.aws/sso/cache/`. That directory contents are sensitive: the cached token is a bearer credential for the portal for the rest of its lifetime. It is short-lived, which is the point, but it is not nothing. ## What happens on each command When you run, say, `aws s3 ls --profile prod-admin`, the credential resolution chain sees an SSO profile, loads the cached token, and calls the portal to fetch role credentials for the configured account and permission set. Those credentials are cached on disk too, and reused until they expire. Only then does the actual S3 call go out, signed with the temporary credentials. Modern AWS SDKs implement the same provider, so application code and tools such as Terraform can consume an SSO profile through `AWS_PROFILE` without any bespoke wrapper. Tools that cannot are usually handled with `aws configure export-credentials`, which prints the resolved temporary credentials in a chosen format — still short-lived, still no stored key. ## The failure you will actually hit The next morning, the first command fails with an error about the SSO token being expired or invalid, sometimes phrased as a request to log in again. The fix is one command: ```bash aws sso login --profile prod-admin ``` The wrong reactions, which interviewers do hear, are "run `aws configure` and paste keys" (that reintroduces exactly the long-lived secret you removed), or "raise the session duration" (that has a hard ceiling and is a security budget, not a convenience dial). `aws sso logout` clears the cached token and role credentials — worth knowing for a shared or borrowed machine. ## Useful details around the edges - `aws sso login --sso-session corp` authenticates the session without naming a profile, refreshing every profile that uses it. - The portal APIs used are ordinary AWS APIs: the CLI lists your assigned accounts and roles through them, which is how `aws configure sso` can offer you a picker instead of asking you to type account numbers. - Because the profile stores the permission set *name*, renaming a permission set breaks every profile that references it — a real operational cost of renaming. ## The shape of a good answer Name the two layers — portal token then role credentials — say that nothing long-lived is written to disk, and describe the expiry symptom and its one-command fix. That is the whole mechanism.