Use Dynobase with AWS IAM Identity Center (SSO)

Dynobase supports AWS IAM Identity Center (formerly AWS SSO) profiles, including profiles that reference an sso-session block. Configure the profile with AWS CLI v2, sign in, then select it in Dynobase. A credential-process wrapper is not required for a standard SSO profile.

Configure and sign in

Run the AWS CLI wizard and choose the account and permission set assigned to you:

aws configure sso --profile work
aws sso login --profile work
aws sts get-caller-identity --profile work
aws configure sso --profile work
aws sso login --profile work
aws sts get-caller-identity --profile work

The last command confirms the account and role without printing credentials. Your organization supplies the start URL and SSO Region; the DynamoDB Region can be different from the SSO Region.

The wizard writes your profile and session configuration to ~/.aws/config. A typical configuration looks like this (replace the example organization, account and role):

[profile work]
sso_session = company
sso_account_id = 123456789012
sso_role_name = DynamoDBDeveloper
region = eu-west-1

[sso-session company]
sso_start_url = https://company.awsapps.com/start
sso_region = eu-west-1
sso_registration_scopes = sso:account:access
[profile work]
sso_session = company
sso_account_id = 123456789012
sso_role_name = DynamoDBDeveloper
region = eu-west-1

[sso-session company]
sso_start_url = https://company.awsapps.com/start
sso_region = eu-west-1
sso_registration_scopes = sso:account:access

Select the profile in Dynobase

Open the profile selector, choose work, and select the Region containing your tables. If Dynobase asks you to authenticate, complete the browser sign-in flow and return to the app. Authentication does not grant extra DynamoDB permissions: the selected permission set still controls which tables and operations are available.

Troubleshoot a missing profile or expired session

• Missing session configuration: the value of sso_session must match an existing [sso-session ...] block. Run aws configure sso --profile work again to repair it.
• Expired sign-in: authenticate again in Dynobase or run aws sso login --profile work, then retry the operation.
• Wrong account or Region: check get-caller-identity and the selected Region before assuming a table is missing.
• Access denied: ask for the specific DynamoDB permissions required by the operation. Repeating SSO login does not change the permission set.
• Custom config location: check the AWS config and credentials file paths used by the app. A terminal and a desktop application can have different environment variables.

For other profile workflows, see Dynobase and AWS Vault and workspace settings. AWS documents the profile and login flow in its IAM Identity Center CLI guide.