aws / aws/aws-toolkit-vscode

AWS Toolkit does not support `login_session` credentials from new `aws login` command

Open
#8,488 2 comments 0 reactions 0 assignees View on GitHub
feature-request
Dominant language
TypeScript
Stars
2k
Forks
807
Avg merge
10h 12m
Merged PRs (30d)
7

Description

## Problem
The AWS Toolkit for any IDE fails to authenticate when using credentials configured with the new `aws login` command. While the AWS CLI works perfectly with these credentials, the AWS Toolkit extension repeatedly fails with "Your session has expired. Please reauthenticate" errors immediately after authentication.

### Environment

* AWS Toolkit Version: 3.91.0
* Kiro Version: Version: 0.8.86
* VSCode Version: Version: 1.107.1
* AWS CLI Version: 2.32.0+
* Operating System: macOS (also reported on other platforms)
* Date: January 8, 2026

### Steps to Reproduce

* Install AWS CLI version 2.32.0 or later
* Run `aws login --profile --region `
* Complete browser-based authentication successfully
* Verify CLI works: `aws sts get-caller-identity --profile ` (succeeds)
* Open IDE with AWS Toolkit extension
* Attempt to connect to AWS or refresh credentials in AWS Toolkit
* Observe authentication failure

## Expected behavior
The AWS Toolkit should recognize and successfully use credentials configured via aws login, similar to how it handles SSO profiles and traditional IAM credentials.

## Actual Behavior

The AWS Toolkit fails to authenticate with the following error pattern:
```
[info] Profile found: {
login_session: 'arn:aws:sts:::assumed-role//',
region: ''
}
[info] Login session value: arn:aws:sts:::assumed-role//, type: string
[info] auth: Updating connection state of profile: to valid
[info] Authentication completed for profile , refreshing credentials...
[info] auth: Handling validation error of connection: profile:
[info] auth: Updating connection state of profile:default to invalid
[error] Console login authentication failed for profile in region : 'CredentialsProviderError: Your session has expired. Please reauthenticate.'
```

The authentication appears to succeed initially but immediately fails when the Toolkit attempts to use the credentials.

### Configuration File

The `~/.aws/config` file contains:

```
[profile ]
login_session = arn:aws:sts:::assumed-role//
region =
```

### Root Cause Analysis

The AWS Toolkit's credential provider does not recognize or properly handle the `login_session` parameter that the new `aws login` command creates in the AWS config file. While the AWS CLI's credential chain has been updated to support this authentication method, the AWS Toolkit has not yet been updated.

### Impact
* Users using the new `aws login` command cannot use AWS Toolkit features
* Users must fall back to alternative authentication methods (SSO, IAM access keys, or credential_process)
* This affects the adoption of the new, more secure `aws login` authentication method

### Workarounds

1. Use credential_process (Recommended Temporary Solution)

As documented in the [AWS CLI User Guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html#cli-configure-sign-in-cached-credentials-process), you can configure the AWS CLI to serve as a process credentials provider:

Step 1: Login with `aws login` first:

`aws login --profile signin`

Step 2: Configure a separate profile in `~/.aws/config` that uses `credential_process`:
```
[profile signin]
login_session = arn:aws:sts:::assumed-role//
region =

[profile process]
credential_process = aws configure export-credentials --profile signin --format process
region =
```

Step 3: Configure AWS Toolkit to use the `process` profile instead of `signin`.

This allows the AWS Toolkit to work with `aws login` credentials by using the CLI as a credential provider.
2. Use IAM Identity Center (SSO)
Configure SSO profiles which are fully supported by AWS Toolkit.
3. Use traditional IAM access keys

Less secure but functional for development environments.
4. Continue using aws login for CLI only

Skip AWS Toolkit integration until native support is added.

### References

* AWS Blog: [Simplified developer access to AWS with 'aws login'](https://aws.amazon.com/blogs/security/simplified-developer-access-to-aws-with-aws-login/)
* AWS CLI Documentation: [Sign in through the AWS Command Line Interface](https://docs.aws.amazon.com/signin/latest/userguide/command-line-sign-in.html)
* AWS CLI Documentation: [Sharing Login credentials as process credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html#cli-configure-sign-in-cached-credentials-process)

## Request

Please add native support for the `login_session` credential type in the AWS Toolkit's credential provider chain to enable direct compatibility with the new `aws login` authentication method, eliminating the need for the `credential_process` workaround.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with AWS CLI 2.32.0 or later, the documented login_session profile, and the AWS Toolkit authentication flow. Read the Toolkit credential provider chain and compare its handling with the CLI's login_session support. Done means the Toolkit authenticates and refreshes credentials directly from login_session without requiring the credential_process workaround, with coverage for the reported profile configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.