Should sam local support named profiles created by aws cli v2 sso commands?

Description

We have sam projects configured to start under a named profile. When that profile’s credentials are populated in the ~/.aws/credentials file, they are sent as expected in requests from sam local to aws resources.

However when the profile credentials are obtained by issuing an aws sso login command, using aws cli v2, they do not seem to get picked up. Calls from sam local functions to aws cloud resources are throwing an error

The security token included in the request is invalid.

Steps to reproduce

Remove named profile credentials from ~/.aws/credentials file

Obtain new credentials via the aws sso login command

Invoke sam local function that accesses an aws cloud resource like s3 or dynamodb

Observed result

Calls to aws cloud resources are rejected with a security token error.

Expected result

Calls to aws cloud resources behave the same as they do when the named profile credentials are obtained from a named profile defined in ~/.aws/credentials file.

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: Windows, Mac
2. sam --version: 0.38.0

Add --debug flag to command you are running

[jplock]

Just ran into this as well. It would be great if I could pass the AWS CLI v2 generated profile name into SAM and have it work out of the box.

[bigwheel]

FYI: Im using linaro-its/aws2-wrap as workaround.