Guidance on using sso profile

[KieranFleckney]

Can you please provide guidance on how to use aws cli sso session with sdk. When using the “newer” sso session verse the legacy (none auto renewing). When I use new way I can’t get the sdk to work in any way.

[profile default]
sso_session = local
sso_account_id = <redacted>
sso_role_name = AdministratorAccess
[sso-session local]
sso_start_url = <redacted>
sso_region = eu-west-1
sso_registration_scopes = sso:account:access

var s3Client = new AmazonS3Client(Amazon.RegionEndpoint.EUWest1);
var buckets = await s3Client.ListBucketsAsync();

Console.WriteLine(buckets.Buckets.Count);

I get this exception Unable to get IAM security credentials from EC2 Instance Metadata Service.

or

var credentials = new Amazon.Runtime.CredentialManagement.SharedCredentialsFile();
if (credentials.TryGetProfile("default", out var profile))
{
    AWSCredentials awsCredentials;
    if (AWSCredentialsFactory.TryGetAWSCredentials(profile, credentials, out awsCredentials))
    {
        var s3Client = new AmazonS3Client(awsCredentials, Amazon.RegionEndpoint.EUWest1);
        var buckets = await s3Client.ListBucketsAsync();

        Console.WriteLine(buckets.Buckets.Count);
        // Use s3Client as needed
    }
}

this way I get issue with missing assemblies for AWSSDK.SSOOIDC then if I add this package I get missing more errors for AWSSDK.SSO and finally it get a error for a null value.

neither of these work and I guess handful of errors. Is the newer way of sso profile just not support for sdk? I mean it has been around for almost 2 years. It hard as there is no documentation on this.

but if i setup the config to use the legacy/older sso sesssion it works fine.

[default]
sso_start_url = <redacted>
sso_region = eu-west-1
sso_account_id = <redacted>
sso_role_name = AdministratorAccess

[dscpinheiro]

The SDK does support the newer format, there are a couple of documentation pages in our developer guide with examples (and please leave feedback there if you think it can be improved): https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/sso-tutorial-cli-and-app.html

The main difference between the example there and your code is that you don't need to use the SharedCredentialsFile class, CredentialProfileStoreChain should be used instead as it retrieves the profile correctly:

var chain = new CredentialProfileStoreChain();
chain.TryGetAWSCredentials("default", out AWSCredentials profileCredentials);

using var s3Client = new AmazonS3Client(profileCredentials, RegionEndpoint.EUWest1);
var response = await s3Client.ListBucketsAsync();
Console.WriteLine(response.Buckets.Count);

And as you mentioned, you do need to add the AWSSDK.SSO and AWSSDK.SSOOIDC dependencies to your project for SSO to work properly.