AWS SSO Login

Purpose

Input Parameters

• profile

  : AWS CLI profile name configured for SSO (default: defined by project, e.g.,

  web-hosting

  )
  • If the profile name is not known/available from project docs or prior context, ask the user which AWS CLI profile to use before running this skill.

Execution Steps

1. Execute

   aws sso login

   command with the specified profile
2. Open browser automatically (or provide a URL to open manually)
3. Complete authentication in the browser
4. Confirm successful authentication

Command Example

# Login with SSO using specified profile
aws sso login --profile <profile-name>

Project Configuration

• Document the default profile name (e.g.,

  web-hosting

  ) in a separate project guide such as

  .github/skills/README.md

  or a skill configuration file.
• Refer to that document when invoking this Skill so the same definition can be reused across repositories without editing the Skill itself.

Output

• SSO session is established and cached locally
• AWS CLI commands can be executed using the specified profile
• Session remains valid for the configured duration (typically 8-12 hours)

Usage Examples

# Verify authentication
aws sts get-caller-identity --profile <profile-name>

# Assume a role (often used after SSO login)
aws sts assume-role --role-arn <role-arn> --role-session-name <session-name> --profile <profile-name>

Prerequisites

• AWS CLI v2 installed (SSO support requires v2 or later)
• SSO configuration set up in

  ~/.aws/config

  for the specified profile
• Web browser available for authentication
• Network access to the SSO authentication endpoint

Notes

• SSO sessions expire after a configured duration (typically 8-12 hours)
• When the session expires, re-execute this skill to re-authenticate
• Browser-based authentication is required; this cannot be fully automated
• For headless environments, consider using

  --no-browser

  flag and manually opening the provided URL
• This skill should be executed before the

  assume-cloudformation-role

  skill if role assumption requires SSO authentication