AWS SSO Named Profiles Support

AWS CLI v2 supports AWS SSO named profiles.

However, CDK CLI cannot resolve SSO named profiles yet.

$ cdk deploy --profile sso-named-profile

Unable to resolve AWS account to use. It must be either configured when you define your CDK or through the environment

Without this feature, users have to login to SSO user portal and fetch credentials for command line and CLI access, which needs to be repeated every time the credentials expire.

Even though CLI v2 is still in preview, it would be good to have this feature implemented for early adopters.

Use Case

• Simplify deployments to multiple-accounts for AWS SSO users.

Proposed Solution

• Read sso_start_url, sso_role_name and sso_account_id from ~/.aws/config file.
• Fetch the accessToken in ~/.aws/sso/cache/ matching sso_start_url.
• Fetch temporary credentials from STS using SSO.get-role-credentials() with accessToken, sso_account_id and sso_role_name parameters.

---

This is a 🚀 Feature Request

[ReidWeb]

Given the CLI is now GA, and it seems a number of other users are facing this issue would it be possible to at least add a note to the docs indicating the lack of support at this time?

[chrichts]

@ericzbeard - is this something that’s being considered at all? Are there blockers for implementing this that we just aren’t aware of? This issue has been open for 2 years, so I just want to know if we should be looking for a more permanent workaround or if we can expect this to be implemented in the foreseeable future