aws sso login --use-device-code fails with dual-stack IAM Identity Center unless AWS_USE_DUALSTACK_ENDPOINT=true

[vultix]

Describe the bug

When an IAM Identity Center instance has been migrated to the new dual-stack endpoints (per the IPv6 support announcement), aws sso login --use-device-code fails at the IdP → AWS handoff with the generic error:

Something doesn't compute
We couldn't verify your sign-in credentials. Please try again.

The default PKCE flow (aws sso login) succeeds with the same configuration.

Setting AWS_USE_DUALSTACK_ENDPOINT=true causes the same device-code login flow to succeed. This is hard to diagnose due to the obscure error.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

aws sso login --use-device-code should complete successfully, or at minimum produce a verification URL from the same endpoint family as the configured sso_start_url. When sso_start_url is a dual-stack URL (*.portal.<region>.app.aws), the CLI should call the dual-stack sso-oidc endpoint (or the service should return a dual-stack verificationUriComplete) so that the SAML exchange is initiated from the endpoint family the IdP is configured for.

Current Behavior

• aws sso login (default PKCE flow): works. Authorize URL: https://oidc.us-east-1.amazonaws.com/authorize?...
• aws sso login --use-device-code: browser opens https://ssoins-<id>.us-east-1.portal.amazonaws.com/#/device?user_code=XXXX-XXXX, Google sign-in succeeds, then the redirect back to AWS fails with "Something doesn't compute / We couldn't verify your sign-in credentials."
• If the user first establishes an AWS access portal session in the same browser (e.g. by completing a normal portal login), the device-code flow then succeeds — because the SAML exchange is skipped entirely when a session already exists.
• AWS_USE_DUALSTACK_ENDPOINT=true aws sso login --use-device-code: works.

Reproduction Steps

Prerequisites:

1. IAM Identity Center instance (primary region us-east-1) using Google Workspace as the external SAML IdP.
2. Google Workspace SAML app configured with the dual-stack sign-in URL, ACS URL, and issuer URL from Identity Center (Settings → Identity source → Manage authentication). Google Workspace only supports a single ACS URL / Entity ID per SAML app, so the IPv4 URLs are replaced, not supplemented — as AWS's own migration guidance prescribes for single-ACS IdPs.
3. sso_start_url in ~/.aws/config set to the dual-stack portal start URL.

Steps:

1. Ensure no existing AWS access portal session in the browser (use a fresh browser profile, or sign out).
2. Run aws sso login --use-device-code.
3. Open the verification URL, enter/confirm the code, and complete Google sign-in.
4. Observe the "Something doesn't compute" error on redirect back to AWS.
5. Re-run with AWS_USE_DUALSTACK_ENDPOINT=true aws sso login --use-device-code — login completes successfully.

Possible Solution

• Derive the sso-oidc endpoint family from the format of the configured sso_start_url (a *.app.aws start URL implies dual-stack endpoints), or
• Have StartDeviceAuthorization return a verificationUriComplete in the same endpoint family as the registered start URL (this part may be service-side rather than CLI-side), and/or
• Document the requirement to set use_dualstack_endpoint = true when the Identity Center instance/IdP has been migrated to dual-stack endpoints, and surface a clearer error than "Something doesn't compute."

Additional Information/Context

No response

CLI version used

aws-cli/2.35.21 Python/3.14.6

Environment details (OS name and version, etc.)

Linux/7.0.0-27-generic exe/x86_64.ubuntu.26