How do I install the AWS Sso Auth Guide skill?

Run npx skillmds@latest add tomevault-io/aws-sso-auth-guide in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the AWS Sso Auth Guide skill do?

AWS SSO discovery, configuration, and terminal usage Use when this capability is needed. It is listed under Product & Planning on SkillMD.

Is AWS Sso Auth Guide safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with AWS Sso Auth Guide?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is AWS Sso Auth Guide free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published AWS Sso Auth Guide?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

AWS Sso Auth Guide by tomevault-io — Agent Skill

Name: AWS Sso Auth Guide
Author: tomevault-io

File contents

AWS SSO Terminal Guide

Discovery: Finding SSO Configuration

Get SSO Instance & Portal URL

# From management account
aws sso-admin list-instances --profile <mgmt-profile>
# Returns: InstanceArn, IdentityStoreId (d-xxxxxxxxxx), OwnerAccountId

# Portal URL format: https://d-xxxxxxxxxx.awsapps.com/start

List Accounts & Permission Sets

# List organization accounts
aws organizations list-accounts --profile <mgmt-profile>

# List permission sets
aws sso-admin list-permission-sets \
  --instance-arn <instance-arn> \
  --profile <mgmt-profile>

# Get permission set name
aws sso-admin describe-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <ps-arn> \
  --profile <mgmt-profile>

# Check account assignments
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <ps-arn> \
  --profile <mgmt-profile>

Configuration

Profile Structure (Recommended)

# ~/.aws/config

[profile my-profile]
sso_session = my-sso
sso_account_id = 123456789012
sso_role_name = AdministratorAccess
region = us-east-1

[sso-session my-sso]
sso_start_url = https://d-xxxxxxxxxx.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

Benefits: Token reuse across profiles, automatic refresh (CLI v2.22.0+)

Interactive Configuration

aws configure sso

Authentication

Login Flow

# Login (PKCE auth - default in CLI v2.22.0+)
aws sso login --profile my-profile

# Login with device code (for headless/remote)
aws sso login --profile my-profile --use-device-code

# Verify
aws sts get-caller-identity --profile my-profile

Token Cache: ~/.aws/sso/cache/

Key Endpoints & Flow

oidc.{region}.amazonaws.com - OIDC authentication
portal.sso.{region}.amazonaws.com - SSO portal
Auth flow: RegisterClient → StartDeviceAuthorization → CreateToken

Troubleshooting

Missing SSO Configuration:

# Error: Missing sso_start_url, sso_region
# Fix: aws configure sso

Expired Token:

# Error: Token is expired
# Fix: aws sso login --profile my-profile

Proxy SSL Issues:

# Error: SSL certificate verification failed
# Fix: Set AWS_CA_BUNDLE to proxy CA certificate
export AWS_CA_BUNDLE=/path/to/proxy-ca.crt

Access Denied:

# Check permission set assignments
aws sso-admin list-account-assignments \
  --instance-arn <arn> \
  --account-id <id> \
  --permission-set-arn <ps-arn>

Quick Reference

CLI Versions:

v2.22.0+: PKCE auth (default), auto-refresh
< v2.22.0: Device code auth

Authorization Types:

PKCE: Same-device, browser required
Device Code: Cross-device, browser optional

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: aws-sso-auth-guidedescription: AWS SSO discovery, configuration, and terminal usage Use when this capability is needed.---# AWS SSO Terminal Guide## Discovery: Finding SSO Configuration### Get SSO Instance & Portal URL```bash# From management accountaws sso-admin list-instances --profile <mgmt-profile># Returns: InstanceArn, IdentityStoreId (d-xxxxxxxxxx), OwnerAccountId# Portal URL format: https://d-xxxxxxxxxx.awsapps.com/start```### List Accounts & Permission Sets```bash# List organization accountsaws organizations list-accounts --profile <mgmt-profile># List permission setsaws sso-admin list-permission-sets \ --instance-arn <instance-arn> \ --profile <mgmt-profile># Get permission set nameaws sso-admin describe-permission-set \ --instance-arn <instance-arn> \ --permission-set-arn <ps-arn> \ --profile <mgmt-profile># Check account assignmentsaws sso-admin list-account-assignments \ --instance-arn <instance-arn> \ --account-id <account-id> \ --permission-set-arn <ps-arn> \ --profile <mgmt-profile>```## Configuration### Profile Structure (Recommended)```ini# ~/.aws/config[profile my-profile]sso_session = my-ssosso_account_id = 123456789012sso_role_name = AdministratorAccessregion = us-east-1[sso-session my-sso]sso_start_url = https://d-xxxxxxxxxx.awsapps.com/startsso_region = us-east-1sso_registration_scopes = sso:account:access```**Benefits:** Token reuse across profiles, automatic refresh (CLI v2.22.0+)### Interactive Configuration```bashaws configure sso```## Authentication### Login Flow```bash# Login (PKCE auth - default in CLI v2.22.0+)aws sso login --profile my-profile# Login with device code (for headless/remote)aws sso login --profile my-profile --use-device-code# Verifyaws sts get-caller-identity --profile my-profile```**Token Cache:** `~/.aws/sso/cache/`## Key Endpoints & Flow- `oidc.{region}.amazonaws.com` - OIDC authentication- `portal.sso.{region}.amazonaws.com` - SSO portal- Auth flow: `RegisterClient` → `StartDeviceAuthorization` → `CreateToken`## Troubleshooting**Missing SSO Configuration:**```bash# Error: Missing sso_start_url, sso_region# Fix: aws configure sso```**Expired Token:**```bash# Error: Token is expired# Fix: aws sso login --profile my-profile```**Proxy SSL Issues:**```bash# Error: SSL certificate verification failed# Fix: Set AWS_CA_BUNDLE to proxy CA certificateexport AWS_CA_BUNDLE=/path/to/proxy-ca.crt```**Access Denied:**```bash# Check permission set assignmentsaws sso-admin list-account-assignments \ --instance-arn <arn> \ --account-id <id> \ --permission-set-arn <ps-arn>```## Quick Reference**CLI Versions:**- v2.22.0+: PKCE auth (default), auto-refresh- < v2.22.0: Device code auth**Authorization Types:**- **PKCE**: Same-device, browser required- **Device Code**: Cross-device, browser optional---> Converted and distributed by [TomeVault](https://tomevault.io/claim/plurigrid) — claim your Tome and manage your conversions.

Frequently asked questions

AWS Sso Auth Guide