Dynomate

AWS Login

Before you use AWS Login

AWS Login uses the same sign-in as the AWS Management Console. It is different from AWS IAM Identity Center. For Identity Center profiles, see SSO Authentication.

You need:

  • A profile with login_session in ~/.aws/config.
  • An AWS account in a commercial AWS Region. Dynomate cannot use AWS Login in the China or AWS GovCloud (US) Regions.

Configure a Login profile

Use the AWS CLI to sign in and create the profile. The command adds login_session to the profile: 

aws login --profile dev
~/.aws/config
[profile dev]
login_session = arn:aws:iam::123456789012:user/developer
region = us-east-1

A role profile can use a Login profile as its source profile. When you select reader, Dynomate uses the dev session to assume the role:

~/.aws/config
[profile reader]
role_arn = arn:aws:iam::123456789012:role/Reader
source_profile = dev
region = us-east-1

Restart Dynomate after you add or rename the profile.

Sign in with your browser

Select the profile as usual. If a valid session is available, Dynomate connects and does not open your browser.

If the connection check fails, Dynomate shows the AWS error and three actions: Refresh, Sign in with browser and Use a code instead. These actions are in Settings, in the connection status in the title bar, and in the profile selector of a request.

  1. Select Sign in with browser.
  2. Sign in to AWS in the browser that opens.
  3. Return to Dynomate.
  4. Wait for Dynomate to check the connection.

If the browser does not open, copy the sign-in link that Dynomate shows. Open the link in a browser that is signed in to AWS.

A sign-in attempt expires after five minutes. Select Cancel to stop an attempt.

Sign in with a code

Use a code when your browser is on a different device, or when the browser cannot return to Dynomate.

  1. Select Use a code instead.
  2. Open the sign-in link on any device.
  3. Sign in to AWS.
  4. Copy the authorization code that AWS shows.
  5. Paste the code into AWS authorization code.
  6. Select Submit code.

The authorization code is long. It is not a six-digit MFA code or a URL.

Use only the code from the current attempt. When you change between browser and code sign-in, Dynomate starts a new attempt.

Sessions and the AWS CLI

Dynomate keeps Login sessions in the same cache as the AWS CLI and the AWS SDKs, at ~/.aws/login/cache. After you sign in one time, the session works in all of these tools. Only your user account can read the cache files.

Dynomate uses the automatic session refresh of the AWS SDK. Sign in again only when Dynomate shows the sign-in actions.

Dynomate uses these environment variables:

  • AWS_CONFIG_FILE
  • AWS_SHARED_CREDENTIALS_FILE
  • AWS_LOGIN_CACHE_DIRECTORY

Sign-in does not change your profile configuration. If other credentials have priority over the Login session, Dynomate uses those credentials.

The sign-in steps show in Logs under AWS Login. Dynomate does not log authorization codes, tokens or sign-in URLs.

Troubleshooting

The browser does not return to Dynomate

  • Select Use a code instead.

Dynomate does not accept the code

  • Paste the full code from the current attempt.
  • Codes from a cancelled attempt do not work.
  • If the attempt expired, start a new attempt.

The identity does not match

  • Sign in with the identity in login_session.

AWS rejects the sign-in

  • Check that your identity has the permissions in the SignInLocalDevelopmentAccess policy.
  • Start a new attempt.

Sign-in succeeds but the connection fails

  • For a role profile, sign-in can succeed when Dynomate cannot assume the role. Check role_arn and the trust policy of the role.
  • Dynomate keeps the new Login session.
  • Select Refresh after you correct the role.

Other connection errors

  • Sign-in does not correct incorrect access keys, AWS permission errors or network errors.
  • Correct the cause, then select Refresh.
Previous SSO authentication Next Local development