feat: Add AWS SSO credential support for SDK v3 (Claude-assisted)#88
Open
dhait wants to merge 1 commit intooss-serverless:mainfrom
Open
feat: Add AWS SSO credential support for SDK v3 (Claude-assisted)#88dhait wants to merge 1 commit intooss-serverless:mainfrom
dhait wants to merge 1 commit intooss-serverless:mainfrom
Conversation
- Add SSO authentication via fromNodeProviderChain - Fix CloudFormation describeChangeSet command mapping - Fix S3 empty response handling for SDK v3 - Add comprehensive SSO documentation - Add 12 tests for SSO functionality
bartelemi
reviewed
Nov 30, 2025
Contributor
bartelemi
left a comment
bartelemi
left a comment
There was a problem hiding this comment.
What can we do to move this forward? This would be an amazing change, SLSv3 & OSS SLS is the last tool in our toolbox that was not supporting SSO, so I'm keen to help out where possible.
| // Enhanced error handling for SSO-specific issues | ||
| if (error.message && error.message.includes('SSO')) { | ||
| const profile = this._getActiveProfile(); | ||
| if (error.message.includes('expired') || error.message.includes('Token has expired')) { |
Contributor
There was a problem hiding this comment.
Second condition is not necessary, both contain "expired"
Suggested change
| if (error.message.includes('expired') || error.message.includes('Token has expired')) { | |
| if (error.message.includes('expired')) { |
| return await this.clientFactory.send(service, command, clientConfig); | ||
| } catch (error) { | ||
| // Enhanced error handling for SSO-specific issues | ||
| if (error.message && error.message.includes('SSO')) { |
Contributor
There was a problem hiding this comment.
A good practice would be to add a .toLowerCase() on the error.message.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds support for AWS SSO (Single Sign-On) credentials when using AWS SDK v3 mode. Users can now authenticate using
aws sso loginand deploy their serverless applications using SSO profiles.Fixes #87
What Changed
Core Features
fromNodeProviderChainfrom@aws-sdk/credential-providersBug Fixes (discovered during implementation)
describeChangeSetto SDK v3 command mappingsContentsproperty for empty bucketsFiles Modified
/lib/plugins/aws/provider.jsfromNodeProviderChain_getActiveProfile()method to determine active AWS profile_getV3BaseConfig()to use credential providers instead of static credentialsgetCredentials()for v3 SDK mode with SSO support_requestV3()with SSO-specific error messages/lib/aws/commands.jsDescribeChangeSetCommandimport and mapping/lib/plugins/aws/deploy/lib/check-for-changes.js/lib/plugins/aws/utils/find-and-group-deployments.js/lib/plugins/aws/remove/lib/bucket.js/docs/guides/credentials.md/test/unit/lib/plugins/aws/provider.test.jsHow to Test
Enable SDK v3 mode (required for SSO support):
export SLS_AWS_SDK_V3=1Login with AWS SSO:
Deploy using SSO profile:
Testing Checklist
npm run lint)Breaking Changes
None. This feature is only active when
SLS_AWS_SDK_V3=1is set. Existing credential methods continue to work as before.Documentation
Updated
/docs/guides/credentials.mdwith:Important Notes
SLS_AWS_SDK_V3=1environment variable)~/.aws/configPerformance Impact
Minimal. The credential provider chain only resolves credentials when needed and caches them appropriately.
Security Considerations
Future Enhancements
Consider making SDK v3 the default mode in a future major release to enable SSO support by default.
NOTE: Claude by Anthropic assisted in the development of this code.