AWS Toolkit does not support `login_session` credentials from new `aws login` command
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 807
- Avg merge
- 10h 12m
- Merged PRs (30d)
- 7
Description
## Problem
The AWS Toolkit for any IDE fails to authenticate when using credentials configured with the new `aws login` command. While the AWS CLI works perfectly with these credentials, the AWS Toolkit extension repeatedly fails with "Your session has expired. Please reauthenticate" errors immediately after authentication.
### Environment
* AWS Toolkit Version: 3.91.0
* Kiro Version: Version: 0.8.86
* VSCode Version: Version: 1.107.1
* AWS CLI Version: 2.32.0+
* Operating System: macOS (also reported on other platforms)
* Date: January 8, 2026
### Steps to Reproduce
* Install AWS CLI version 2.32.0 or later
* Run `aws login --profile --region `
* Complete browser-based authentication successfully
* Verify CLI works: `aws sts get-caller-identity --profile ` (succeeds)
* Open IDE with AWS Toolkit extension
* Attempt to connect to AWS or refresh credentials in AWS Toolkit
* Observe authentication failure
## Expected behavior
The AWS Toolkit should recognize and successfully use credentials configured via aws login, similar to how it handles SSO profiles and traditional IAM credentials.
## Actual Behavior
The AWS Toolkit fails to authenticate with the following error pattern:
```
[info] Profile found: {
login_session: 'arn:aws:sts:::assumed-role//',
region: ''
}
[info] Login session value: arn:aws:sts:::assumed-role//, type: string
[info] auth: Updating connection state of profile: to valid
[info] Authentication completed for profile , refreshing credentials...
[info] auth: Handling validation error of connection: profile:
[info] auth: Updating connection state of profile:default to invalid
[error] Console login authentication failed for profile in region : 'CredentialsProviderError: Your session has expired. Please reauthenticate.'
```
The authentication appears to succeed initially but immediately fails when the Toolkit attempts to use the credentials.
### Configuration File
The `~/.aws/config` file contains:
```
[profile ]
login_session = arn:aws:sts:::assumed-role//
region =
```
### Root Cause Analysis
The AWS Toolkit's credential provider does not recognize or properly handle the `login_session` parameter that the new `aws login` command creates in the AWS config file. While the AWS CLI's credential chain has been updated to support this authentication method, the AWS Toolkit has not yet been updated.
### Impact
* Users using the new `aws login` command cannot use AWS Toolkit features
* Users must fall back to alternative authentication methods (SSO, IAM access keys, or credential_process)
* This affects the adoption of the new, more secure `aws login` authentication method
### Workarounds
1. Use credential_process (Recommended Temporary Solution)
As documented in the [AWS CLI User Guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html#cli-configure-sign-in-cached-credentials-process), you can configure the AWS CLI to serve as a process credentials provider:
Step 1: Login with `aws login` first:
`aws login --profile signin`
Step 2: Configure a separate profile in `~/.aws/config` that uses `credential_process`:
```
[profile signin]
login_session = arn:aws:sts:::assumed-role//
region =
[profile process]
credential_process = aws configure export-credentials --profile signin --format process
region =
```
Step 3: Configure AWS Toolkit to use the `process` profile instead of `signin`.
This allows the AWS Toolkit to work with `aws login` credentials by using the CLI as a credential provider.
2. Use IAM Identity Center (SSO)
Configure SSO profiles which are fully supported by AWS Toolkit.
3. Use traditional IAM access keys
Less secure but functional for development environments.
4. Continue using aws login for CLI only
Skip AWS Toolkit integration until native support is added.
### References
* AWS Blog: [Simplified developer access to AWS with 'aws login'](https://aws.amazon.com/blogs/security/simplified-developer-access-to-aws-with-aws-login/)
* AWS CLI Documentation: [Sign in through the AWS Command Line Interface](https://docs.aws.amazon.com/signin/latest/userguide/command-line-sign-in.html)
* AWS CLI Documentation: [Sharing Login credentials as process credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html#cli-configure-sign-in-cached-credentials-process)
## Request
Please add native support for the `login_session` credential type in the AWS Toolkit's credential provider chain to enable direct compatibility with the new `aws login` authentication method, eliminating the need for the `credential_process` workaround.
Contributor guide
Research direction
Start by reproducing the failure with AWS CLI 2.32.0 or later, the documented login_session profile, and the AWS Toolkit authentication flow. Read the Toolkit credential provider chain and compare its handling with the CLI's login_session support. Done means the Toolkit authenticates and refreshes credentials directly from login_session without requiring the credential_process workaround, with coverage for the reported profile configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100