We spent three weeks debugging a single sign-on login that would not start. The cause was one line in a shell profile. The goal was simple. Stop copying temporary AWS keys out of the Kion portal every hour and let the Kion CLI fetch them instead. The CLI kept asking for a password and never opened a browser. We checked the SAML config, the callback port, the Okta app assignment and a known-good file from an administrator. All of it was fine. The real problem was a leftover KION_IDMS_ID export from an earlier attempt. The Kion CLI gives environment variables priority over its config file, so it quietly forced the password path. Now every account has an AWS CLI profile that asks Kion for credentials on demand, and our coding agent uses read-only profiles by default. If a colleague's identical config works and yours does not, compare environments before you compare files. #AWS #DevOps #CloudSecurity
Getting AWS credentials from Kion without copy and paste
How we moved from pasting temporary keys out of the Kion web portal to AWS CLI profiles that fetch credentials on demand, what slowed us down, and what we would do the same way again.
Where we started
Our AWS accounts sit behind Kion, which hands out short-lived credentials after a single sign-on login. The routine was to open the Kion portal, pick an account and role, copy the access key, secret and session token, and paste them into the AWS credentials file. The keys expire after about an hour, so this repeated all day across several accounts.
The goal was to use the Kion CLI so that credentials arrive and refresh without anyone touching a clipboard, and to make that work for our AI coding agent as well.
What we ended up with
A Kion CLI config that points at our identity provider and lists one favorite per account and role. One AWS CLI profile per favorite, using credential_process so the AWS CLI asks Kion for keys each time it needs them. A rules file for the coding agent that names the profiles and says to prefer read-only ones. A tighter command allowlist in the agent, so broad aws commands no longer run without approval.
How to set it up
1. Configure the CLI
Your Kion administrator needs to give you the Kion URL, the SAML metadata URL from your identity provider and the SAML service provider issuer. Quote account numbers, because YAML drops a leading zero from an unquoted number. Use access type web for roles that only offer console access.
Run kion util validate-saml afterward. It checks local config and reachability only, which matters later in this story.
2. Add AWS CLI profiles
Each favorite gets a matching profile. While your Kion login is valid, no prompt appears. When it expires, the next call opens your browser for sign-on and then completes.
3. Tell the coding agent
We put a short rules file in the agent's global rules folder. It says never to handle AWS keys, to pass the profile flag first so allowlist prefixes match, to default to read-only profiles, and to ask before any write.
What went wrong along the way
The setup took minutes. The login problem took about three weeks of back and forth with the Kion administrators, and the cause was on our own machine.
We found it by running the CLI in debug mode, listing the KION environment variables and rerunning with them unset. The login flow ran immediately.
Smaller snags
A typo landed us in the wrong account. A trailing period on a favorite name started a session in a different account. Run aws sts get-caller-identity before anything that matters. The Kion role name is not always the IAM role name. The account matched, so this is cosmetic. The agent's allowlist was far too broad. A bare aws command ran with no approval, deletes included. We replaced it with narrow read-only entries. The agent matches commands by prefix. That is why the profile flag goes first.
What we would tell another team
Before you open a support ticket about a login flow, run the CLI in debug mode and print the relevant environment variables. A passing validation check only covers local config and reachability. If a colleague's identical config works and yours does not, compare environments before comparing files. Use read-only roles for exploration and for AI agents by default. Back up your AWS config before editing it, and avoid pasting or printing it.
What we have not verified
How long a Kion login lasts before the browser prompt returns. How the coding agent behaves while a browser login is pending. Whether every agent version reads the global rules folder without a restart.
Comments