SsoCredentialsProvider

CredentialsProvider that uses AWS Single Sign-On (AWS SSO) to source credentials. The provider is expected to be configured for the AWS Region where the AWS SSO user portal is hosted.

The provider does not initiate or perform the AWS SSO login flow. It is expected that you have already performed the SSO login flow using (e.g. using the AWS CLI aws sso login). The provider expects a valid non-expired access token for the AWS SSO user portal URL in ~/.aws/sso/cache. If a cached token is not found, it is expired, or the file is malformed an exception will be thrown.

Instantiating AWS SSO provider directly

You can programmatically construct the AWS SSO provider in your application, and provide the necessary information to load and retrieve temporary credentials using an access token from ~/.aws/sso/cache.

val source = SsoCredentialsProvider(
    accountId = "123456789",
    roleName = "SsoReadOnlyRole",
    startUrl = "https://my-sso-portal.awsapps.com/start",
    ssoRegion = "us-east-2"
)

// Wrap the provider with a caching provider to cache the credentials until their expiration time
val ssoProvider = CachedCredentialsProvider(source)

It is important that you wrap the provider with CachedCredentialsProvider if you are programmatically constructing the provider directly. This prevents your application from accessing the cached access token and requesting new credentials each time the provider is used to source credentials.

Additional Resources

• Configuring the AWS CLI to use AWS Single Sign-On

• AWS Single Sign-On User Guide

Parameters