Skip to content

AWS IAM Identity Center (SSO)

StormTunnel supports IAM Identity Center profiles through the AWS CLI. With a Premium license you can also sign in from within StormTunnel.

Configure an AWS Profile

Use AWS CLI v2 to create an SSO profile:

aws configure sso

This writes the profile (and its sso-session, if you use one) to ~/.aws/config. If your administrator gave you a profile, use that profile instead. StormTunnel reads profiles from ~/.aws/config; choose Refresh Profiles in the tunnel editor or Reload Profiles in Settings > AWS after you change the file.

Sign In with the AWS CLI

aws sso login --profile PROFILE

In StormTunnel, select the same profile in the tunnel editor. When the AWS session expires, run the login command again. StormTunnel resolves credentials with aws configure export-credentials, so profiles that use sso-session work, and AWS CLI v2 is required. This applies when you start a tunnel and when you use Validate or Test Permissions in the editor.

Sign In with StormTunnel

In-app SSO sign-in requires a Premium license:

  1. Select the SSO profile in the tunnel editor, or open Settings > AWS, find SSO Authentication, and choose the SSO Profile.
  2. Click Sign In with SSO…. If a token already exists but has expired, the button is Sign In Again… or Re-authenticate….
  3. Click Open Browser, enter the code shown, and complete sign-in in your browser.

The same actions appear in the tunnel editor when an SSO profile needs sign-in, and in the AWS SSO section of the menu bar popup. In Settings > AWS you can also Refresh Token and Sign Out. Without Premium the buttons offer an upgrade, and the editor shows the aws sso login command to run instead.

StormTunnel stores its in-app SSO token in macOS Keychain. It refreshes the token when AWS allows it; if the identity-provider session has expired, sign in again. This token is separate from the AWS CLI's cached SSO token.

Troubleshooting

  • Confirm that the profile exists in ~/.aws/config and includes the SSO start URL, SSO region, account, and role (or a valid sso_session).
  • Make sure the tunnel's AWS Region matches the region of the EC2 instance. The SSO region is separate.
  • If an error mentions an expired or missing SSO session, run aws sso login --profile PROFILE again.
  • If a message says MFA is required or the AWS CLI is missing, follow the instructions in the message. Install AWS CLI v2 if aws --version does not report version 2.
  • If in-app sign-in is used, return to Settings > AWS and sign in again.

See AWS Settings and AWS IAM permissions.