Skip to content

devo aws-login

AWS SSO authentication and profile management.

Synopsis

devo aws-login [COMMAND] [OPTIONS]

Description

Automates AWS SSO authentication and credential management. Eliminates manual credential management by automating the AWS SSO authentication process. Opens your browser, handles authentication, and caches credentials automatically.

Commands

login

Login to AWS using SSO with a specific profile.

devo aws-login login [PROFILE] [OPTIONS]

Arguments:

  • PROFILE - AWS profile name (optional, shows interactive menu if omitted)

If a default profile was previously configured via set-default and the logged-in profile matches it, ~/.aws/credentials [default] is automatically updated after a successful login.

Example:

# Interactive profile selection
devo aws-login login
# → Opens interactive menu to select a profile, then launches browser for SSO

# Login to specific profile
devo aws-login login production
# → Opens browser for SSO authentication, caches credentials on success

list

List all AWS profiles with detailed status.

devo aws-login list [OPTIONS]

Shows all configured profiles with their status (Active/Expired/Expiring Soon).

Example:

devo aws-login list

Output:

═══ AWS Profile Expiration Status ═══

┏━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━┓
┃ Profile              ┃ Status          ┃ Expires At (Local)        ┃ Time Remaining       ┃
┡━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━┩
│ production           │ Valid           │ 2026-03-01 14:30:00       │ 7h 45m               │
│ dev                  │ Expiring Soon   │ 2026-03-01 07:05:00       │ 8m                   │
│ staging              │ Expired         │ 2026-02-28 23:00:00       │ Expired              │
└──────────────────────┴─────────────────┴───────────────────────────┴──────────────────────┘

configure

Configure a new SSO profile interactively.

devo aws-login configure [PROFILE] [OPTIONS]

Arguments:

  • PROFILE - AWS profile name (optional, prompts if omitted)

Uses AWS CLI's SSO wizard to configure a new profile. The wizard will:

  1. Prompt for SSO start URL
  2. Open browser for authentication
  3. Show available accounts and roles
  4. Configure default region

Example:

# Interactive configuration
devo aws-login configure
# → Runs AWS CLI SSO wizard; prompts for SSO URL, region, account, and role

# Configure specific profile
devo aws-login configure production
# → Same wizard pre-filled with the "production" profile name

refresh

Refresh expired or expiring credentials.

devo aws-login refresh [OPTIONS]

Automatically refreshes all profiles that are expired or expiring within 10 minutes. Groups profiles by SSO session to minimize login prompts.

If a default profile was previously configured via set-default, the [default] section in ~/.aws/credentials is automatically re-written after a successful refresh — but only for profiles that passed credential verification.

Example:

devo aws-login refresh
# → Refreshes all expired/expiring profiles; opens browser only if SSO token has also expired

set-default

Set a profile as the default.

devo aws-login set-default [PROFILE] [OPTIONS]

Arguments:

  • PROFILE - AWS profile name (optional, shows interactive menu if omitted)

Options:

  • --set-env - Also export AWS_PROFILE in the shell config file (see below)

By default, writes the profile's temporary credentials as [default] in ~/.aws/credentials. This lets you use the AWS CLI without --profile immediately, without modifying any shell config file.

aws s3 ls
aws sts get-caller-identity
devo codeartifact-login

Shell config update (optional)

Pass --set-env to also persist AWS_PROFILE in your shell config:

  • Linux/macOS: Updates .bashrc, .zshrc, or config.fish
  • Windows: Sets user environment variable with setx
  • Git Bash (Windows): Updates .bashrc

To enable this behaviour permanently without the flag:

devo config set aws_login.set_env_profile true

Example:

# Interactive selection (writes credentials only)
devo aws-login set-default

# Set specific profile (writes credentials only)
devo aws-login set-default production

# Write credentials and update shell config
devo aws-login set-default production --set-env

Configuration

[sso-session my-sso]
sso_start_url = https://my-company.awsapps.com/start
sso_region = us-east-1

[profile production]
sso_session = my-sso
sso_account_id = 123456789012
sso_role_name = Developer
region = us-east-1
output = json

Legacy Format

[profile production]
sso_start_url = https://my-company.awsapps.com/start
sso_region = us-east-1
sso_account_id = 123456789012
sso_role_name = Developer
region = us-east-1
output = json

Both formats are supported.

Requirements

  • AWS CLI v2
  • Web browser for SSO authentication
  • Network access to SSO portal

Exit Codes

Code Description
0 Success
1 Error (authentication failed, profile not found, etc.)

See Also

Default credentials auto-update

Once a default profile is configured with set-default, devo keeps ~/.aws/credentials [default] in sync automatically across three flows:

Command When [default] is updated
set-default <profile> Always — writes fresh credentials immediately
login <profile> When the logged-in profile matches the configured default
refresh When the default profile is among the successfully verified profiles after refresh

The configured default profile is stored in ~/.devo/config.json under aws_login.default_credentials_profile. When [default] credentials expire (typically every 1 hour) but the SSO token is still valid (up to 12 hours), re-running set-default re-exports without requiring browser re-authentication.

Notes

  • Account credentials expire after 1-8 hours (organization-dependent)
  • SSO tokens can last up to 12 hours
  • Credentials cached securely by AWS CLI
  • Supports multiple profiles for different accounts/roles