You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
AuthArea: what it touches
ImprovementsKind: in v2.1.221,
What probably matters to youSection of the release
What
With AWS_CONFIG_FILE set, credentials are resolved by reading the shared config and credentials files directly instead of going through the general ini provider, which cuts out a slower resolution path for plain SSO profiles.
Details
Requires sso_account_id and sso_role_name, and bails out if any other credential mechanism is configured: static keys, credential_process, role_arn, source_profile, credential_source, web_identity_token_file.
Reads the SSO token cache keyed by a sha1 of the session or start URL and validates expiry with a small zod schema.
Calls GetRoleCredentials against a region-pinned portal.sso host, with the result cached.
Any failure falls back to the previous fromIni path.
Evidence
host-pinned SSO leg failed
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Read from
Names in the bundleAWS_CONFIG_FILEsso_account_idsso_role_name
