feat(auth): add console credentials sign-in option to login webview by keenwilson · Pull Request #8401 · aws/aws-toolkit-vscode

keenwilson · 2025-12-09T07:37:53Z

Problem

Users can use a beginner-friendly interface to authenticate with AWS Console credentials to obtain temporary credentials, especially for new AWS users. This GUI-based offers alternative to aws login command-line authentication.

Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html

Solution

Add "Console credentials - recommended" option to login webview
Restrict profile name input to alphanumeric, underscore, and hyphen characters (following profile name pattern)
Show "Opening AWS sign-in in your default browser..." during authentication
Redirect to explorer view upon successful sign-in

Note:

The UI flow follows the same pattern as IAM credentials setup, with these key differences:
- Console credentials form takes profile name and region (optional)
- IAM credentials form takes access key and secret key
- Different telemetry emitted for credential source ID:
  - Console credentials: 'consoleCredentials'
  - IAM credentials: 'sharedCredentials'
Telemetry for credential source ID is tracked via telemetry: Add console login as valid credential source ID aws-toolkit-common#1108
AWS CLI returns exit code 255 if browser-based authentication is not completed, this prevents partial/incomplete authentication states
Reuse fromLoginCredentials provider instance to prevent multiple credential resolution attempts and maintain consistent refresh behavior at resolveProviderWithCancel in sharedCredentialsProvider

UI Changes

Added "Console credentials - recommended" as first option in login selection

Created profile name input with validation for letters, numbers, - and _
Made region selection optional with us-east-1 default

Shows clear guidance during browser authentication flow

Opening AWS sign-in in your default browser.

Attempt to update AWS CLI if the version < 2.32.0

Known Issue: Windows PATH Environment After AWS CLI Installation

When installing or updating AWS CLI v2 through the toolkit on Windows machine within a managed enterprise or workspace environment, the installation may appear successful, but users receive the error:

[error] aws.toolkit.auth.consoleLogin: Error: Failed to verify or install AWS CLI [CliInstallFailed]
	 -> Error: Could not verify installed CLIs

This typically occurs because the installer successfully places the necessary files in the default directory (C:\Program Files\Amazon\AWSCLIV2\), but security policies or user permissions within the workspace prevent the installer from correctly or immediately updating the system's PATH environment variable. The command prompt doesn't know where to look for the aws.exe file.

You can verify the installation using the full path and contact your IT support to add the installation path (C:\Program Files\Amazon\AWSCLIV2\) to the System variables PATH environment variable.

"C:\Program Files\Amazon\AWSCLIV2\aws.exe" --version

Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
Your code changes must meet the guidelines in CONTRIBUTING.md.
License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

github-actions · 2025-12-09T07:38:10Z

This pull request modifies code in src/* but no tests were added/updated.
- Confirm whether tests should be added or ensure the PR description explains why tests are not required.
This pull request implements a feat or fix, so it must include a changelog entry (unless the fix is for an unreleased feature). Review the changelog guidelines.
- Note: beta or "experiment" features that have active users should announce fixes in the changelog.
- If this is not a feature or fix, use an appropriate type from the title guidelines. For example, telemetry-only changes should use the telemetry type.

vicheey · 2025-12-09T17:46:32Z

+            const profilePattern = /^[a-zA-Z0-9_-]+$/
+            return this.profileName.length <= 0 || !this.selectedRegion || !profilePattern.test(this.profileName)
+        },
+        preventInvalidChars(event: KeyboardEvent) {


curious, will this get trigger for copy-paste operation?

Great catch. I just tested and confirmed paste bypass character restrictions into the profile name field. I will add input validation regardless of input method. Thank you!

Example: pasting " 11:24 AM" will show as "1124AM" profile name.

vicheey · 2025-12-09T17:50:14Z

            } else if (this.app === 'AMAZONQ') {
                this.selectedLoginOption = LoginOption.BUILDER_ID
            } else if (this.app === 'TOOLKIT') {
-                this.selectedLoginOption = LoginOption.ENTERPRISE_SSO


Won't this be a breaking change? If so, should we call this out in the change log?

I agree we should document this noticeable UX change. I'll add another changelog entry for the change in the default pre-selection .

We already have a changelog for the overall console credentials feature here.

vicheey · 2025-12-09T17:55:41Z

 export enum LoginOption {
    NONE,
    BUILDER_ID,
+    CONSOLE_CREDENTIAL,


Do we need to add anything here?

https://github.com/keenwilson/aws-toolkit-vscode/blob/f4baf2f1b433089dc7c5d00fc455caf6c683fc47/packages/core/src/login/webview/vue/types.ts#L48-L64

Thanks for catching this type safety. I will add 'auth_consoleCredentialsOption' to the AuthUiClick type union.

reedham-aws · 2025-12-09T18:26:06Z

+                    :isSelected="selectedLoginOption === LoginOption.CONSOLE_CREDENTIAL"
+                    :itemId="LoginOption.CONSOLE_CREDENTIAL"
+                    :itemText="'Use credentials from the AWS Console'"
+                    :itemTitle="'Console credentials - recommended'"


Nit: It would be nice if there was a way that 'recommended' could be a smaller font. Like how we have 'new' in some places of the console, but it's not the same size or color as the regular text. This is not blocking or anything, just might be nice as a follow-up.

Thanks for the suggestion on following existing AWS Console UI patterns. We can use the existing itemSubTitle prop.

I'll update the console credentials option to use itemSubTitle="'recommended'" instead of appending it to the title.

reedham-aws · 2025-12-09T18:29:20Z

                if (this.shouldDisableIamContinue()) {
                    return
                }
+                this.previousStage = this.stage


Do we need previousStage set for when this.stage === 'SSO_FORM'?

We currently only use previousStage to show the correct authenticating message for console credentials vs IAM flows. I will add that to SSO_FORM for consistency. Thank you!

reedham-aws · 2025-12-09T18:47:45Z

@@ -0,0 +1,4 @@
+{
+	"type": "Feature",
+	"description": "AWS Toolkit login webview now pre-selects Console credentials (previously Enterprise SSO) as the recommended authentication option. xisting Enterprise SSO users are unaffected and can still select their preferred authentication method."


Nit: 'xisting' -> 'Existing'

Thanks for catching this!

Will-ShaoHua · 2025-12-10T22:45:28Z

            return this.profileName.length <= 0 || this.accessKey.length <= 0 || this.secretKey.length <= 0
        },
+        shouldDisableConsoleSessionContinue() {
+            const profilePattern = /^[a-zA-Z0-9_-]+$/


make it constant?

/^[a-zA-Z0-9_-]+$/

Thanks for the feedback. I tried time-boxing making/importing profile pattern as a constant. It led to Vue rendering issues:

Direct imports and data() prevented Vue from rendering

setup() caused crashes during profile input validation

Inline regex pattern is more reliable with Vue's reactivity system

Sagemaker IAM profile here also uses inline regex. I will revert constant commit in favor of inline pattern validation.

…, underscore, and hyphen are allowed

…ws#8401) ## Problem Users can use a beginner-friendly interface to authenticate with AWS Console credentials to obtain temporary credentials, especially for new AWS users. This GUI-based offers alternative to `aws login` command-line authentication. Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sign-in.html ## Solution - Add "Console credentials - recommended" option to login webview - Restrict profile name input to alphanumeric, underscore, and hyphen characters (following [profile name pattern](https://github.com/keenwilson/aws-toolkit-vscode/blob/89739bc176c28321f64cd672664014d1ddfed533/packages/core/src/auth/consoleSessionUtils.ts#L48)) - Show "Opening AWS sign-in in your default browser..." during authentication - Redirect to explorer view upon successful sign-in Note: - The UI flow follows the same pattern as IAM credentials setup, with these key differences: - Console credentials form takes profile name and region (optional) - IAM credentials form takes access key and secret key - Different telemetry emitted for credential source ID: - Console credentials: 'consoleCredentials' - IAM credentials: 'sharedCredentials' - Telemetry for credential source ID is tracked via aws/aws-toolkit-common#1108 - AWS CLI returns exit code 255 if browser-based authentication is not completed, this prevents partial/incomplete authentication states - Reuse `fromLoginCredentials` provider instance to prevent multiple credential resolution attempts and maintain consistent refresh behavior at [resolveProviderWithCancel](https://github.com/aws/aws-toolkit-vscode/blob/eb11eb59318ab83a1f609e472eab760ea38201d1/packages/core/src/auth/providers/sharedCredentialsProvider.ts#L256) in sharedCredentialsProvider ## UI Changes - Added "Console credentials - recommended" as first option in login selection <img width="1122" height="633" alt="1-start" src="https://github.com/user-attachments/assets/3d46b1ee-9730-4834-ac64-328a5b92227c" /> - Created profile name input with validation for letters, numbers, - and _ - Made region selection optional with us-east-1 default <img width="1122" height="631" alt="4-console-profile" src="https://github.com/user-attachments/assets/f1acfffb-40b6-4f7e-a87a-96da6b0ff59d" /> - Shows clear guidance during browser authentication flow <img width="1150" height="765" alt="Opening AWS sign-in in your default browser." src="https://github.com/user-attachments/assets/9f04fea4-0980-4eef-9b3f-e5c2caa9fbc5" /> - Attempt to update AWS CLI if the version < 2.32.0 <img width="1086" height="710" alt="Screenshot 2025-12-11 at 4 31 17 PM" src="https://github.com/user-attachments/assets/77cbc5b6-b238-4db1-bc21-d178081bc298" /> ### Known Issue: Windows PATH Environment After AWS CLI Installation When installing or updating AWS CLI v2 through the toolkit on Windows machine within a managed enterprise or workspace environment, the installation may appear successful, but users receive the error: ``` [error] aws.toolkit.auth.consoleLogin: Error: Failed to verify or install AWS CLI [CliInstallFailed] -> Error: Could not verify installed CLIs ``` This typically occurs because the installer successfully places the necessary files in the default directory (`C:\Program Files\Amazon\AWSCLIV2\`), but security policies or user permissions within the workspace prevent the installer from correctly or immediately updating the system's PATH environment variable. The command prompt doesn't know where to look for the `aws.exe` file. You can verify the installation using the full path and contact your IT support to add the installation path (`C:\Program Files\Amazon\AWSCLIV2\`) to the System variables `PATH` environment variable. ```powershell "C:\Program Files\Amazon\AWSCLIV2\aws.exe" --version ``` --- - Treat all work as PUBLIC. Private `feature/x` branches will not be squash-merged at release time. - Your code changes must meet the guidelines in [CONTRIBUTING.md](https://github.com/aws/aws-toolkit-vscode/blob/master/CONTRIBUTING.md#guidelines). - License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

keenwilson requested a review from a team as a code owner December 9, 2025 07:37

keenwilson force-pushed the feature/console-session-profile branch 4 times, most recently from be60aee to fa6a4a3 Compare December 9, 2025 08:28

vicheey reviewed Dec 9, 2025

View reviewed changes

reedham-aws reviewed Dec 9, 2025

View reviewed changes

vicheey approved these changes Dec 9, 2025

View reviewed changes

reedham-aws approved these changes Dec 9, 2025

View reviewed changes

keenwilson force-pushed the feature/console-session-profile branch 2 times, most recently from 58703a6 to 9252253 Compare December 10, 2025 02:35

Will-ShaoHua reviewed Dec 10, 2025

View reviewed changes

Comment thread packages/core/src/login/webview/vue/toolkit/backend_toolkit.ts Outdated

Will-ShaoHua reviewed Dec 10, 2025

View reviewed changes

Comment thread packages/core/src/login/webview/vue/toolkit/backend_toolkit.ts

keenwilson added 7 commits December 10, 2025 15:10

feat(auth): add console credentials sign-in option to login webview

ad036d4

chore: trigger CI

558b9cf

add input validation for profile name to ensure only letters, numbers…

ab1c06e

…, underscore, and hyphen are allowed

Follow AWS Console UI patterns for recommended label

3640b13

Use sentence case for design language

0b679d4

chore: trigger CI

9e2d01d

Make profile pattern constant

6305d79

keenwilson force-pushed the feature/console-session-profile branch from 7dca5d3 to 6305d79 Compare December 11, 2025 00:47

keenwilson added 4 commits December 10, 2025 22:34

Ask for user action before refreshing token

09578e2

revert: \"Make profile pattern constant\"

4cf6d96

Add buffer for file system caching to .aws/config

cfb9231

Use updated telemetry type

a7f0aa5

Will-ShaoHua approved these changes Dec 11, 2025

View reviewed changes

keenwilson added 2 commits December 11, 2025 13:07

Make command error message clear

4e6652e

Mark aws_consoleLoginCLISuccess as may active on reload

a9f3b9d

Attempt to update aws-cli if aws login command not found

a4acd6d

keenwilson force-pushed the feature/console-session-profile branch from 8db0e6d to a4acd6d Compare December 12, 2025 00:23

keenwilson added 2 commits December 11, 2025 16:44

chore: trigger CI

452ef44

chore: trigger CI

424ea90

ashishrp-aws approved these changes Dec 12, 2025

View reviewed changes

ashishrp-aws merged commit 52f40c2 into aws:feature/console-session-profile Dec 12, 2025
25 checks passed

Uh oh!

Conversation

keenwilson commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

UI Changes

Known Issue: Windows PATH Environment After AWS CLI Installation

Uh oh!

github-actions Bot commented Dec 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

keenwilson commented Dec 9, 2025 •

edited

Loading