telemetry: Add console login as valid credential source ID - #1108
Merged
Will-ShaoHua merged 1 commit intoDec 9, 2025
Merged
Conversation
vicheey
approved these changes
Dec 9, 2025
chungjac
approved these changes
Dec 9, 2025
Will-ShaoHua
approved these changes
Dec 9, 2025
ashishrp-aws
pushed a commit
to aws/aws-toolkit-vscode
that referenced
this pull request
Dec 12, 2025
…8401) ## Problem Users can use a beginner-friendly interface to authenticate with AWS Console credentials to obtain temporary credentials, especially for new AWS users. This GUI-based offers alternative to `aws login` command-line authentication. Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html ## Solution - Add "Console credentials - recommended" option to login webview - Restrict profile name input to alphanumeric, underscore, and hyphen characters (following [profile name pattern](https://github.com/keenwilson/aws-toolkit-vscode/blob/89739bc176c28321f64cd672664014d1ddfed533/packages/core/src/auth/consoleSessionUtils.ts#L48)) - Show "Opening AWS sign-in in your default browser..." during authentication - Redirect to explorer view upon successful sign-in Note: - The UI flow follows the same pattern as IAM credentials setup, with these key differences: - Console credentials form takes profile name and region (optional) - IAM credentials form takes access key and secret key - Different telemetry emitted for credential source ID: - Console credentials: 'consoleCredentials' - IAM credentials: 'sharedCredentials' - Telemetry for credential source ID is tracked via aws/aws-toolkit-common#1108 - AWS CLI returns exit code 255 if browser-based authentication is not completed, this prevents partial/incomplete authentication states - Reuse `fromLoginCredentials` provider instance to prevent multiple credential resolution attempts and maintain consistent refresh behavior at [resolveProviderWithCancel](https://github.com/aws/aws-toolkit-vscode/blob/eb11eb59318ab83a1f609e472eab760ea38201d1/packages/core/src/auth/providers/sharedCredentialsProvider.ts#L256) in sharedCredentialsProvider ## UI Changes - Added "Console credentials - recommended" as first option in login selection <img width="1122" height="633" alt="1-start" src="https://github.com/user-attachments/assets/3d46b1ee-9730-4834-ac64-328a5b92227c" /> - Created profile name input with validation for letters, numbers, - and _ - Made region selection optional with us-east-1 default <img width="1122" height="631" alt="4-console-profile" src="https://github.com/user-attachments/assets/f1acfffb-40b6-4f7e-a87a-96da6b0ff59d" /> - Shows clear guidance during browser authentication flow <img width="1150" height="765" alt="Opening AWS sign-in in your default browser." src="https://github.com/user-attachments/assets/9f04fea4-0980-4eef-9b3f-e5c2caa9fbc5" /> - Attempt to update AWS CLI if the version < 2.32.0 <img width="1086" height="710" alt="Screenshot 2025-12-11 at 4 31 17 PM" src="https://github.com/user-attachments/assets/77cbc5b6-b238-4db1-bc21-d178081bc298" /> ### Known Issue: Windows PATH Environment After AWS CLI Installation When installing or updating AWS CLI v2 through the toolkit on Windows machine within a managed enterprise or workspace environment, the installation may appear successful, but users receive the error: ``` [error] aws.toolkit.auth.consoleLogin: Error: Failed to verify or install AWS CLI [CliInstallFailed] -> Error: Could not verify installed CLIs ``` This typically occurs because the installer successfully places the necessary files in the default directory (`C:\Program Files\Amazon\AWSCLIV2\`), but security policies or user permissions within the workspace prevent the installer from correctly or immediately updating the system's PATH environment variable. The command prompt doesn't know where to look for the `aws.exe` file. You can verify the installation using the full path and contact your IT support to add the installation path (`C:\Program Files\Amazon\AWSCLIV2\`) to the System variables `PATH` environment variable. ```powershell "C:\Program Files\Amazon\AWSCLIV2\aws.exe" --version ``` --- - Treat all work as PUBLIC. Private `feature/x` branches will not be squash-merged at release time. - Your code changes must meet the guidelines in [CONTRIBUTING.md](https://github.com/aws/aws-toolkit-vscode/blob/master/CONTRIBUTING.md#guidelines). - License: I confirm that my contribution is made under the terms of the Apache 2.0 license.
aws-ajangg
pushed a commit
to aws-ajangg/aws-toolkit-vscode
that referenced
this pull request
Jan 15, 2026
…ws#8401) ## Problem Users can use a beginner-friendly interface to authenticate with AWS Console credentials to obtain temporary credentials, especially for new AWS users. This GUI-based offers alternative to `aws login` command-line authentication. Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html ## Solution - Add "Console credentials - recommended" option to login webview - Restrict profile name input to alphanumeric, underscore, and hyphen characters (following [profile name pattern](https://github.com/keenwilson/aws-toolkit-vscode/blob/89739bc176c28321f64cd672664014d1ddfed533/packages/core/src/auth/consoleSessionUtils.ts#L48)) - Show "Opening AWS sign-in in your default browser..." during authentication - Redirect to explorer view upon successful sign-in Note: - The UI flow follows the same pattern as IAM credentials setup, with these key differences: - Console credentials form takes profile name and region (optional) - IAM credentials form takes access key and secret key - Different telemetry emitted for credential source ID: - Console credentials: 'consoleCredentials' - IAM credentials: 'sharedCredentials' - Telemetry for credential source ID is tracked via aws/aws-toolkit-common#1108 - AWS CLI returns exit code 255 if browser-based authentication is not completed, this prevents partial/incomplete authentication states - Reuse `fromLoginCredentials` provider instance to prevent multiple credential resolution attempts and maintain consistent refresh behavior at [resolveProviderWithCancel](https://github.com/aws/aws-toolkit-vscode/blob/eb11eb59318ab83a1f609e472eab760ea38201d1/packages/core/src/auth/providers/sharedCredentialsProvider.ts#L256) in sharedCredentialsProvider ## UI Changes - Added "Console credentials - recommended" as first option in login selection <img width="1122" height="633" alt="1-start" src="https://github.com/user-attachments/assets/3d46b1ee-9730-4834-ac64-328a5b92227c" /> - Created profile name input with validation for letters, numbers, - and _ - Made region selection optional with us-east-1 default <img width="1122" height="631" alt="4-console-profile" src="https://github.com/user-attachments/assets/f1acfffb-40b6-4f7e-a87a-96da6b0ff59d" /> - Shows clear guidance during browser authentication flow <img width="1150" height="765" alt="Opening AWS sign-in in your default browser." src="https://github.com/user-attachments/assets/9f04fea4-0980-4eef-9b3f-e5c2caa9fbc5" /> - Attempt to update AWS CLI if the version < 2.32.0 <img width="1086" height="710" alt="Screenshot 2025-12-11 at 4 31 17 PM" src="https://github.com/user-attachments/assets/77cbc5b6-b238-4db1-bc21-d178081bc298" /> ### Known Issue: Windows PATH Environment After AWS CLI Installation When installing or updating AWS CLI v2 through the toolkit on Windows machine within a managed enterprise or workspace environment, the installation may appear successful, but users receive the error: ``` [error] aws.toolkit.auth.consoleLogin: Error: Failed to verify or install AWS CLI [CliInstallFailed] -> Error: Could not verify installed CLIs ``` This typically occurs because the installer successfully places the necessary files in the default directory (`C:\Program Files\Amazon\AWSCLIV2\`), but security policies or user permissions within the workspace prevent the installer from correctly or immediately updating the system's PATH environment variable. The command prompt doesn't know where to look for the `aws.exe` file. You can verify the installation using the full path and contact your IT support to add the installation path (`C:\Program Files\Amazon\AWSCLIV2\`) to the System variables `PATH` environment variable. ```powershell "C:\Program Files\Amazon\AWSCLIV2\aws.exe" --version ``` --- - Treat all work as PUBLIC. Private `feature/x` branches will not be squash-merged at release time. - Your code changes must meet the guidelines in [CONTRIBUTING.md](https://github.com/aws/aws-toolkit-vscode/blob/master/CONTRIBUTING.md#guidelines). - License: I confirm that my contribution is made under the terms of the Apache 2.0 license.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When users authenticate using AWS Console credentials in the VS Code toolkit, we want to emit telemetry with
credentialSourceId: 'consoleCredentials'during the Console Credential Setup flow.Solution
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.