AWS SSO (IAM Identity Center)

The AWS SSO tab implements the same OAuth 2.0 device-authorization flow as aws sso login. DynamoOps registers itself as an OIDC client with IAM Identity Center, opens the AWS verification page in your default browser and waits for you to approve. Once approved it lists the accounts and permission sets you can access, fetches short-lived role credentials for the one you pick and connects. No access keys are involved at any point.

From ~/.aws/configchips

One chip per SSO-enabled profile found in your AWS config (profiles with sso_start_url or an sso_session). Clicking a chip pre-fills the start URL, regions and remembers the account and role for preselection.

SSO start URLurlrequired

Your access portal, for example https://my-org.awsapps.com/start. The scheme is added and trailing slashes removed automatically.

SSO regionselectrequired

The region where IAM Identity Center is enabled for your organization.

DynamoDB regionselectrequired

The region whose tables you want to open after signing in.

Environmenttoggle

None, Dev, QA, Staging or Prod.

The last used start URL, regions, account and role are remembered and pre-filled the next time you open the tab. Press 🌐 Sign in with AWS in browser (or Enter in the URL field) to continue.

[profile prod-admin]
sso_session   = my-org
sso_account_id = 123456789012
sso_role_name = AdministratorAccess
region        = eu-west-1

[sso-session my-org]
sso_start_url = https://my-org.awsapps.com/start
sso_region    = us-east-1

1. A browser tab opens

   The AWS verification page appears with the device code already filled in. DynamoOps shows the same confirmation code on screen so you can compare them.

2. Sign in and approve

   Authenticate with your identity provider if prompted, then approve the request for “DynamoOps”.

3. Come back to the app

   DynamoOps polls AWS every few seconds and advances automatically. Use Open the page again if you closed the tab, or Cancel to go back.

The request stays valid for about ten minutes. If it expires, is denied or lost, you are returned to the form with a clear message and can try again.

After approval the pane shows “Signed in to <your portal host>” and two selectors.

• AWS account — every account assigned to your SSO user, listed as “Name (id)” and sorted by name.
• Role — the permission sets available in the selected account. Changing the account reloads the list.
• Save profile — optionally store this start URL, account and role under a name for one-click reconnects.

Click Connect. DynamoOps fetches role credentials, validates them with ListTablesand shows the toast “Signed in as <role> @ <account>”. The header displays a 🛡️ <role> badge without a countdown, because renewal is automatic.

Two links help you manage the session: ← Change start URL returns to step 1 while keeping the cached token, and Forget this SSO session deletes DynamoOps’ cached token for that portal so the next sign-in opens the browser again. The AWS CLI’s own cache is never touched.

When the SSO token itself expires, renewal stops and subsequent AWS calls fail. Return to the login screen and sign in again; your saved profile will pre-select the account and role.