Auth & login

awsutopia uses the normal AWS credential chain — the same profiles your AWS CLI already knows. SSO profiles are the recommended path.

Log in

awsutopia login --profile my-sso
awsutopia login --list                 # profiles from ~/.aws/config
awsutopia login --profile my-sso --json

For SSO profiles, login runs:

aws sso login --profile <name>

Then verifies identity with sts:GetCallerIdentity. You'll get back who you're acting as (account + ARN) so you know the right hat is on before you create anything.

Missing credentials

If nothing resolves, the CLI exits 3 with something like:

{
  "ok": false,
  "error": {
    "code": "AUTH_MISSING",
    "message": "Unable to resolve AWS credentials.",
    "hint": "…"
  }
}

Fix: configure SSO once (aws configure sso), then awsutopia login --profile …. Or set AWS_PROFILE / pass --profile on each command.

Flags

Flag	Meaning
--profile	AWS profile (else AWS_PROFILE)
--region	Region override
--list	Show profiles from ~/.aws/config
--dry-run	Show planned SSO / identity checks only
--json	Machine-readable envelope

No long-lived keys required for day-to-day use. Your account, your credentials, your bill.