Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.221 Home All releases ←olderv2.1.220 v2.1.222newer→
Claude Code v2.1.221

Fast-path AWS SSO credential resolution for profile-based auth

You'll notice
Useful3 Signal0
Auth Notable not in their notes

AWS SSO profile logins resolve faster via a direct fast path, falling back if anything unusual is configured.

AWS_CONFIG_FILEsso_account_idsso_role_name
What

With AWS_CONFIG_FILE set, credentials are resolved by reading the shared config and credentials files directly instead of going through the general ini provider, which cuts out a slower resolution path for plain SSO profiles.

Details
  • Requires sso_account_id and sso_role_name, and bails out if any other credential mechanism is configured: static keys, credential_process, role_arn, source_profile, credential_source, web_identity_token_file.
  • Reads the SSO token cache keyed by a sha1 of the session or start URL and validates expiry with a small zod schema.
  • Calls GetRoleCredentials against a region-pinned portal.sso host, with the result cached.
  • Any failure falls back to the previous fromIni path.
Evidence

host-pinned SSO leg failed

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.221 →