IAM Identity Center
Sign in to an Identity Center portal and get every account and role you can reach.
An Identity Center integration is one portal start URL. rolle signs in through your browser (OIDC authorization code with PKCE, returning to a loopback port) and lists every account and permission set your user can reach. Each pair becomes a session named Account/Role.
rolle integration add aws-sso --alias acme --start-url https://acme.awsapps.com/start --region us-east-1
rolle integration login acme # opens the browser
rolle integration login acme --no-browser # device code, for terminals without a browser
rolle integration sync acme # rediscover accounts and roles
rolle integration logout acme # sign out and stop its sessions| Flag | Meaning |
|---|---|
--alias |
Short name for the portal |
--start-url |
Portal start URL |
--region |
Region that hosts the portal |
Sessions from a portal
Roles group under their account in the desktop app. Sync adds new roles and removes roles you can no longer reach. A started role calls GetRoleCredentials and renews on its own while the portal sign-in is valid.
The credential lifetime is the permission set’s session duration, set by your Identity Center administrator (often 1 to 12 hours). The Assume role duration setting does not apply here; it covers chained assume-role sessions.
Import
rolle imports portals from the AWS CLI config (sso-session and legacy sso_start_url sections) and from Granted profiles. If the AWS CLI already holds a valid token for a portal, rolle reuses it and you do not sign in again.