{"version":"2.1.221","anchor":"fast-path-aws-sso-credential-resolution-for-profile-based-au","canonical_anchor":"fast-path-aws-sso-credential-resolution-for-profile-based-au","heading":"Fast-path AWS SSO credential resolution for profile-based auth","tier":"notice","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/fast-path-aws-sso-credential-resolution-for-profile-based-au","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### Fast-path AWS SSO credential resolution for profile-based auth\n\nAWS SSO profile logins resolve faster via a direct fast path, falling back if anything unusual is configured.\n\n**What**\n\nWith `AWS_CONFIG_FILE` set, credentials are resolved by reading the shared config and credentials files directly instead of going through the general ini provider, which cuts out a slower resolution path for plain SSO profiles.\n\n**Details**\n\n- Requires `sso_account_id` and `sso_role_name`, and bails out if any other credential mechanism is configured: static keys, credential_process, role_arn, source_profile, credential_source, web_identity_token_file.\n- Reads the SSO token cache keyed by a sha1 of the session or start URL and validates expiry with a small zod schema.\n- Calls GetRoleCredentials against a region-pinned portal.sso host, with the result cached.\n- Any failure falls back to the previous fromIni path.\n\n**Evidence**\n\n`host-pinned SSO leg failed`\n\n- Area: Auth\n- Names: `AWS_CONFIG_FILE`, `sso_account_id`, `sso_role_name`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}