`aws sso login` should respect credential expiration

[benkehoe]

Describe the feature

Currently, aws sso login goes through the log in process whenever it's called. So if I have two profiles foo and bar that share the same AWS SSO configuration (i.e., sso_start_url and sso_region), when I call aws sso login --profile foo, it will pop up a browser window, log me in, etc., resulting in a valid token being cached in ~/.aws/sso/cache. If I then call aws sso login --profile bar (or aws sso login --profile foo again, for that matter), despite having a valid token for that config, it will go through the entire login process again, resulting in a new token.

Use Case

It's unnecessary work, and it's exacerbated by the argument to aws sso login being --profile, which leads people to think they need to call it whenever they're using a particular profile (I wrote an explainer to help people understand they don't need to do that).

Proposed Solution

aws sso login should check the expiration of the cached token, and exit out successfully if the token is not expired. There should be a --force-refresh option to override this.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CLI version used

N/A

Environment details (OS name and version, etc.)

N/A

[lorengordon]

So much this, yes, please!

[gondalez]

I came here to report/request this also 🙏 💯

My team and I use aws sso login during development and found having to log in breaks our concentration multiple times a day.

We use this fairly crude workaround script, but it is messy to make available to all of our usages.
I would much rather delete it and use aws sso login directly 😌 !

if aws sts get-caller-identity > /dev/null ; then
  echo '🔑 AWS Credentials AOK ✅'
else
  echo '🔑 AWS Credential NOK ❎. Logging in via SSO...'
  aws sso login
fi

[nmiekley]

Thanks for working on this! This would also solve #5972, wouldn't it?

[benkehoe]

It looks like it's the same issue

[benkehoe]

I should note that aws-sso-util login does this already. https://github.com/benkehoe/aws-sso-util/blob/master/docs/login.md

[ixti]

@gondalez that's awesome. I've modified your solution for myself a bit:

message="$(aws sts get-caller-identity 2>&1)"
exit_code="$?"

case "$exit_code" in
  0)
    echo -e "\e[32m🔑 AWS SSO credentials are valid.\e[0m"
    ;;

  255)
    echo -e "\e[33m🔑 AWS SSO credentials are expired. Logging in...\e[0m"
    aws sso login
    ;;

  *)
    echo -e "\e[31m🔑 Something went wrong...\e[0m" >&2
    echo "$message" >&2
    exit $exit_code
esac