AWS CLI Profiles and SSO Setup: A Guide for Developers

Managing multiple cloud environments requires a robust approach to authentication. Mastering AWS CLI Profiles and SSO setup allows developers to switch between staging, production, and personal accounts without the risk of using the wrong credentials. As AWS has shifted its recommendation toward IAM Identity Center, formerly known as SSO, understanding how to configure these profiles is essential for modern cloud architecture.

Understanding the Evolution of AWS Authentication

In the early days of the AWS CLI, developers primarily relied on long-lived access keys stored in a plain text credentials file. This approach presented significant security risks. If a laptop was compromised or a developer accidentally committed their .aws/credentials file to a public repository, the keys could be exploited indefinitely until manually revoked.

The modern standard involves short-lived tokens. By utilizing AWS IAM Identity Center, you can centralize your identity management. When you perform an AWS CLI Profiles and SSO setup, your machine stores a temporary session rather than a permanent secret. This session expires automatically, significantly reducing the blast radius of a potential security breach.

Configuring Your First SSO Profile

To begin the process, you need the Start URL and the Region provided by your organization's AWS administrator. The configuration is handled through a guided wizard in your terminal.

1. Open your terminal and run aws configure sso.
2. Enter the SSO session name, which is a local identifier for your session.
3. Provide the SSO start URL and the SSO region.
4. Your browser will open to authorize the request.
5. After authorization, the CLI will list the accounts and roles available to you.

Once these steps are complete, the CLI updates your .aws/config file. It creates a profile that references the SSO session. You can now use this profile by appending --profile profile-name to your commands or by setting the AWS_PROFILE environment variable.

Managing Multiple Profiles Effectively

Developers often work across dozens of accounts. Manually typing the profile name for every command is tedious and error-prone. There are several ways to manage this complexity.

One common method is using environment variables. By running export AWS_PROFILE=staging, all subsequent AWS commands in that terminal session will use the staging credentials. However, this is local to that specific terminal tab. If you open a new tab, you must remember to set the variable again.

Another approach involves using specialized tools or workspaces that preserve context. This is where a dedicated developer tool can provide a more organized environment.

Integration with Deska for Cloud Workflows

When working with complex AWS environments, visualization is as important as the commands themselves. Deska provides an infinite canvas workspace where you can manage your AWS CLI Profiles and SSO setup across multiple visual panels.

In Deska, you can open several terminals side by side on a single canvas. You might have one terminal dedicated to your production profile and another for development. Because Deska is a local-first application, your configuration files and AWS tokens remain strictly on your machine.

The Ask Deska assistant can also interact with your terminal panels. You can ask the assistant to help you verify which profile is currently active or to run a series of AWS commands across different accounts. This helps maintain a clear overview of your infrastructure without losing track of which credentials are active in which window.

Comparing Profile Management Approaches

There are various ways to handle AWS credentials. The following table compares traditional methods with modern SSO-based workflows.

While static keys are still used for certain automated CI/CD processes, they are no longer recommended for local development machines. The AWS CLI Profiles and SSO setup provides a much more secure and scalable foundation.

Advanced Configuration: The Config File

The configuration file located at ~/.aws/config is the heart of your CLI setup. A well-organized file makes it easier to navigate dozens of roles. You can define specific configurations for each profile, such as the default output format (json, text, or table) and the default region.

A typical SSO profile entry looks like this:

[profile developer-role]
sso_session = my-org-session
sso_account_id = 123456789012
sso_role_name = DeveloperAccess
region = us-east-1
output = json

By separating the sso_session definition from the individual profiles, you can re-authenticate once and gain access to all profiles linked to that session. This reduces the number of times you need to interact with the browser for login.

Automating Tasks with AI Agents

Modern development often involves repetitive infrastructure tasks. Using coding agents like Claude Code or OpenCode within your workspace can accelerate these workflows.

In Deska, these agents run as panels side by side with your code editor and terminals. You can give an agent a task, such as checking the status of an S3 bucket or listing EC2 instances across different profiles. Since Deska supports mobile monitoring through a secure relay, you can check the progress of these long-running tasks from your phone while away from your desk.

FAQ

How do I fix AWS SSO session expired errors?

When your session expires, you must run aws sso login --profile profile-name. This will re-trigger the browser authentication flow. If you use a shared session for multiple profiles, logging in once for the session will refresh all associated profiles.

Can I use AWS CLI Profiles with third party tools?

Most modern tools that interact with AWS, such as Terraform or the AWS SDKs, natively support the AWS_PROFILE environment variable and the shared configuration file. If a tool does not support SSO profiles directly, you may need a helper tool to convert SSO tokens into temporary environment variables.

Where is the AWS CLI SSO configuration stored?

The configuration metadata is stored in ~/.aws/config. The actual cached access tokens and session information are stored in the ~/.aws/sso/cache directory in JSON format. Do not edit the cache files manually, as this can corrupt your session.

Improving Your Development Environment

Setting up your AWS CLI Profiles and SSO setup correctly is only the first step. To truly optimize your productivity, you need a workspace that brings all your tools together. Deska offers a free desktop app for Mac, Windows, and Linux that allows you to organize your terminals, editors, and AI agents on an infinite canvas.

Whether you are managing a single personal project or a massive multi-account enterprise architecture, having a clear visual representation of your work helps prevent mistakes. You can download Deska today to start building a more efficient cloud development environment.