• (Recommended) SSO token provider configuration – Extended session durations. Includes support for custom session durations.

• Legacy non-refreshable configuration – Uses a fixed, eight-hour session.

• AWS IAM Identity Center User Guide

• AWS IAM Identity Center Portal API Reference

• sso_start_url

• sso_region

• sso_account_id

• sso_role_name

Configure this functionality by using the following:

sso_start_url - shared AWSconfig file setting

The URL that points to your organization's IAM Identity Center issuer URL or access portal URL. For more information, seeUsing the AWS access portal in theAWS IAM Identity Center User Guide.

To find this value, open theIAM Identity Center console, view theDashboard, findAWS access portal URL.

• Alternatively, starting with version2.22.0 of the AWS CLI, you can instead use the value forAWS Issuer URL.

sso_region - shared AWSconfig file setting

The AWS Region that contains your IAM Identity Center portal host; that is, the Region you selected before enabling IAM Identity Center. This is independent from your default AWS Region, and can be different.

For a complete list of the AWS Regions and their codes, seeRegional Endpoints in theAmazon Web Services General Reference. To find this value, open theIAM Identity Center console, view theDashboard, and findRegion.

sso_account_id - shared AWSconfig file setting

The numeric ID of the AWS account that was added through the AWS Organizations service to use for authentication.

To see the list of available accounts, go to theIAM Identity Center console and open theAWS accounts page. You can also see the list of available accounts using theListAccounts API method in theAWS IAM Identity Center Portal API Reference. For example, you can call the AWS CLI methodlist-accounts.

sso_role_name - shared AWSconfig file setting

The name of a permission set provisioned as an IAM role that defines the user's resulting permissions. The role must exist in the AWS account specified bysso_account_id. Use the role name, not the role Amazon Resource Name (ARN).

Permission sets have IAM policies and custom permissions policies attached to them and define the level of access that users have to their assigned AWS accounts.

To see the list of available permission sets per AWS account, go to theIAM Identity Center console and open theAWS accounts page. Choose the correct permission set name listed in the AWS accounts table. You can also see the list of available permission sets using theListAccountRoles API method in theAWS IAM Identity Center Portal API Reference. For example, you can call the AWS CLI methodlist-account-roles.

sso_registration_scopes - shared AWSconfig file setting

A comma-delimited list of valid scope strings to be authorized for thesso-session. An application can request one or more scopes, and the access token issued to the application is limited to the scopes granted. A minimum scope ofsso:account:access must be granted to get a refresh token back from the IAM Identity Center service. For the list of available access scope options, seeAccess scopes in theAWS IAM Identity Center User Guide.

These scopes define the permissions requested to be authorized for the registered OIDC client and access tokens retrieved by the client. Scopes authorize access to IAM Identity Center bearer token authorized endpoints.

This setting doesn't apply to the legacy non-refreshable configuration. Tokens issued using the legacy configuration are limited to scopesso:account:access implicitly.