メニュー
AWS SSO discovery, configuration, and terminal usage
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Systematic process for analyzing and modernizing legacy applications to comply with the 12-Factor App methodology. Covers code analysis, configuration externalization, dependency management, and container/Kubernetes best practices.
Backup and recovery solution for K3s clusters. Includes scheduled, pre-shutdown, and manual backup strategies with recovery procedures.
Configure high-availability load balancing with HAProxy and NGINX reverse proxies. Covers health checks, automatic failover, sticky sessions, and stats monitoring for containerized backends.
Deploy serverless applications on Cloudflare Workers. Covers project setup, JavaScript handler patterns, routing, deployment with Wrangler, and API token configuration. Suitable for APIs, proxies, edge computing, and request transformation.
Deploy containerized applications to AWS EC2 and expose them publicly via Cloudflare Tunnel with automatic HTTPS. Eliminates need for load balancers, SSL certificates, or public inbound ports.
Guide for using Beads (bd), a dependency-aware issue tracker for AI agents. Issues chained together like beads.
| name | aws-sso-auth-guide |
| description | AWS SSO discovery, configuration, and terminal usage |
| license | MIT |
| tags | ["aws","sso","authentication","iam-identity-center"] |
| metadata | {"author":"Stakpak <team@stakpak.dev>","version":"1.0.2"} |
# From management account
aws sso-admin list-instances --profile <mgmt-profile>
# Returns: InstanceArn, IdentityStoreId (d-xxxxxxxxxx), OwnerAccountId
# Portal URL format: https://d-xxxxxxxxxx.awsapps.com/start
# List organization accounts
aws organizations list-accounts --profile <mgmt-profile>
# List permission sets
aws sso-admin list-permission-sets \
--instance-arn <instance-arn> \
--profile <mgmt-profile>
# Get permission set name
aws sso-admin describe-permission-set \
--instance-arn <instance-arn> \
--permission-set-arn <ps-arn> \
--profile <mgmt-profile>
# Check account assignments
aws sso-admin list-account-assignments \
--instance-arn <instance-arn> \
--account-id <account-id> \
--permission-set-arn <ps-arn> \
--profile <mgmt-profile>
# ~/.aws/config
[profile my-profile]
sso_session = my-sso
sso_account_id = 123456789012
sso_role_name = AdministratorAccess
region = us-east-1
[sso-session my-sso]
sso_start_url = https://d-xxxxxxxxxx.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access
Benefits: Token reuse across profiles, automatic refresh (CLI v2.22.0+)
aws configure sso
# Login (PKCE auth - default in CLI v2.22.0+)
aws sso login --profile my-profile
# Login with device code (for headless/remote)
aws sso login --profile my-profile --use-device-code
# Verify
aws sts get-caller-identity --profile my-profile
Token Cache: ~/.aws/sso/cache/
oidc.{region}.amazonaws.com - OIDC authenticationportal.sso.{region}.amazonaws.com - SSO portalRegisterClient → StartDeviceAuthorization → CreateTokenMissing SSO Configuration:
# Error: Missing sso_start_url, sso_region
# Fix: aws configure sso
Expired Token:
# Error: Token is expired
# Fix: aws sso login --profile my-profile
Proxy SSL Issues:
# Error: SSL certificate verification failed
# Fix: Set AWS_CA_BUNDLE to proxy CA certificate
export AWS_CA_BUNDLE=/path/to/proxy-ca.crt
Access Denied:
# Check permission set assignments
aws sso-admin list-account-assignments \
--instance-arn <arn> \
--account-id <id> \
--permission-set-arn <ps-arn>
CLI Versions:
Authorization Types: