Logging into SSO from a script only when needed?

[kaihendry]

Say I have a script that requires sso login to work. My expectation is that if I already have valid tokens aws sso login would be fast, instead the behaviour on aws-cli/2.17.64 Python/3.12.6 Darwin/23.6.0 source/arm64 is to login AGAIN. A workaround is something like:

profile=${1:-mine}
echo $profile
aws --profile $profile sts get-caller-identity || (BROWSER="chrome --profile-directory='Profile 2' %s" aws --profile $profile sso login)
aws --profile $profile s3 ls

Could it please be improved?

Tbh I am not sure how to see my valid tokens since I work across many profiles / roles.

[uldyssian-sh]

AWS CLI does not have a built-in “only login if needed” mode for aws sso login.

aws sso login is an interactive authorization step (browser/device flow). The CLI won’t silently re-authenticate in the background, and depending on version/platform it may still launch the login flow even if you already have a valid cached token. The supported pattern is exactly what you’re already doing: try an AWS call first, then run aws sso login only if it fails due to expired/invalid SSO token.

A practical script pattern is:

profile=${1:-mine}

aws --profile "$profile" sts get-caller-identity >/dev/null 2>&1 ||
aws --profile "$profile" sso login

aws --profile "$profile" s3 ls

If you want to see whether you have a valid token, AWS CLI stores SSO tokens in the cache under:

~/.aws/sso/cache/

Those files are JSON and include an expiresAt field. For example:

ls -1 ~/.aws/sso/cache/*.json

cat ~/.aws/sso/cache/.json

If you’re working across many profiles/roles, use the newer shared SSO session configuration (sso-session in ~/.aws/config) so multiple profiles can reuse the same cached SSO session, instead of each profile behaving like a separate login context.

In short:

Don’t call aws sso login unconditionally in scripts.

Probe with a cheap call (like sts get-caller-identity), and only run aws sso login when the probe fails.

Token state is visible in ~/.aws/sso/cache/ via the expiresAt timestamp.

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊