# Aws Sso

> Use when AWS CLI commands fail with SSO token expiration errors like "Token has expired", "SSO session has expired", or "Error when retrieving credentials".

- **Type:** Skill
- **Install:** `agentstack add skill-dnouri-ai-config-aws-sso`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [dnouri](https://agentstack.voostack.com/s/dnouri)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [dnouri](https://github.com/dnouri)
- **Source:** https://github.com/dnouri/ai-config/tree/master/skills/aws-sso

## Install

```sh
agentstack add skill-dnouri-ai-config-aws-sso
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# AWS SSO Re-Authentication

This skill handles AWS SSO token expiration. Use it when AWS commands fail with authentication errors.

## Detect Auth Failure

Trigger this skill when you see errors like:
- `Token has expired and refresh failed`
- `The SSO session has expired`
- `Error when retrieving credentials`
- `The SSO access token has expired`

## Re-Authentication Flow

### Step 1: Start login in tmux

Run the login command in a tmux session with `--no-browser` to capture the URL:

```bash
tmux new-session -d -s aws-sso 'aws sso login --profile  --no-browser > /tmp/pi-tmux-aws-sso.log 2>&1'
```

### Step 2: Wait briefly, then read the URL

```bash
sleep 1
cat /tmp/pi-tmux-aws-sso.log
```

The output will contain:
```
Browser will not be automatically opened.
Please visit the following URL:

https://oidc..amazonaws.com/authorize?...
```

### Step 3: Present URL to user

Show the user the URL and ask them to complete authentication:

```
⚠️ AWS SSO token expired for profile ``.

Please open this URL in your browser to authenticate:

Let me know when you've completed the login.
```

### Step 4: Verify authentication

After user confirms, check if login succeeded:

```bash
cat /tmp/pi-tmux-aws-sso.log
```

Look for `Successfully logged into Start URL:` in the output.

Then verify credentials work:

```bash
aws sts get-caller-identity --profile 
```

### Step 5: Clean up

```bash
tmux kill-session -t aws-sso 2>/dev/null
rm -f /tmp/pi-tmux-aws-sso.log
```

## List Available Profiles

```bash
grep '^\[profile' ~/.aws/config | sed 's/\[profile \(.*\)\]/\1/'
```

## Check Token Status

```bash
aws sts get-caller-identity --profile  2>&1
```

## Rules

1. **Only use this skill for auth failures** - not for general AWS work
2. **Always use `--no-browser`** - lets us capture and show the URL
3. **Use tmux** - keeps the login process running independently
4. **Wait for user confirmation** - never retry automatically after auth failure
5. **Be specific** about which profile needs login
6. **Clean up** the tmux session and log file when done

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [dnouri](https://github.com/dnouri)
- **Source:** [dnouri/ai-config](https://github.com/dnouri/ai-config)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-dnouri-ai-config-aws-sso
- Seller: https://agentstack.voostack.com/s/dnouri
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.