Levandor

AWS CLI Access via Identity Center

2 min read

How AWS CLI access to the four BESS accounts works on Andras’s mac since 2026-07-21: AWS IAM Identity Center (SSO) profiles in ~/.aws/config, replacing the old saml2aws (AzureAD) flow. Verified end to end on 2026-07-21.

Quick Reference 

aws sso login --sso-session alpiq-sso            # one browser login, covers all 4 profiles
rtk proxy aws sts get-caller-identity --profile bessos-dev
aws sso logout

Profiles: bessos-dev, bessos-test, bessos-int, bessos-prod.

Configuration

~/.aws/config holds one SSO session plus four profiles.

[sso-session alpiq-sso]
sso_start_url = https://identitycenter.amazonaws.com/ssoins-69878836cb6e09c7
sso_region = eu-central-1
sso_registration_scopes = sso:account:access

All four profiles use sso_session = alpiq-sso, sso_role_name = Developer, region = eu-central-1, output = json.

ProfileAccount IDAccount name
bessos-dev794038257734bit-bessos-dev-interintra-1
bessos-test071128452852bit-bessos-test-interintra-1
bessos-int621553445748bit-bessos-int-interintra-1
bessos-prod282467977019bit-bessos-prod-interintra-1

These are the same four accounts as the deployment matrix in mando AGENTS.md section 14.1 (see Mando Deployment Ceremony).

Login flow

aws sso login --sso-session alpiq-sso opens the browser PKCE flow. One login covers all four profiles; the token is cached under ~/.aws/sso/cache/. aws sso logout ends the session.

Verification:

rtk proxy aws sts get-caller-identity --profile bessos-dev
# arn:aws:sts::794038257734:assumed-role/AWSReservedSSO_Developer_.../andras.lederer@alpiq.com

Gotchas

RTK shell hook mangles aws output

With the RTK hook active, plain aws ... prints AWS: ? ? instead of the real result. Always prefix with rtk proxy: rtk proxy aws sts get-caller-identity --profile bessos-dev. Same class of hazard as the cargo test RTK false-green documented in AGENTS.md section 11.

Enumerating accounts before profiles exist

To discover accounts/roles when ~/.aws/config has no profiles yet, pull accessToken from the newest ~/.aws/sso/cache/*.json and call the SSO portal API directly:

aws sso list-accounts --access-token "$TOKEN" --region eu-central-1
aws sso list-account-roles --access-token "$TOKEN" --account-id 794038257734 --region eu-central-1
  • eu-west-1 is a read-only Identity Center replica. If eu-central-1 is down, a second [sso-session alpiq-sso-dub] with sso_region = eu-west-1 can be added. Not configured today.
  • saml2aws is left in place but unused. ~/.saml2aws (AzureAD provider) still exists; nothing should be driven through it anymore.

Practical use

Primary purpose is reaching AWS resources behind the mando deployment ceremony:

  • Dev/test ECR: 843164609896.dkr.ecr.eu-central-1.amazonaws.com/poc/mando/deploy (via bessos-dev / bessos-test)
  • Int/prod ECR: 748634852998.dkr.ecr.eu-central-1.amazonaws.com/poc/mando (via bessos-int / bessos-prod)
  • ECS task/service inspection for the bess-os service, image-tag verification after a terraform apply

See Mando Deployment Ceremony for how those image tags and ECS pins are produced and bumped.

Graph View

Backlinks