THE APPROACH
An IAM user—not Identity Center—with aws login
This setup is for an individual IAM user when IAM Identity Center is not part of the account yet. The user signs in through the AWS Management Console, then aws login opens a browser and exchanges that authenticated session for temporary local credentials. No IAM access key needs to be created or stored on the machine.
CREATE THE USER
Give the developer console access
- Open IAM → Users and choose Create user.
- Enter a descriptive user name and enable access to the AWS Management Console.
- Add the user to a group that grants only the AWS service permissions required for the work.
- Require a password reset when appropriate, then configure MFA for the user.
Do not create an access key for this workflow. The console password establishes the browser session; aws login supplies temporary credentials to the CLI.
AWS CLI
Start a named local session
Install AWS CLI version 2.32.0 or newer, then authenticate a named profile. The command opens the default browser, where the IAM user completes sign-in. The resulting session can remain valid for up to 12 hours.
aws --version
aws login --profile local-dev
# Confirm which identity the CLI is using
aws sts get-caller-identity --profile local-devUse the same profile explicitly in commands, or set AWS_PROFILE=local-dev for the current shell.
CLOSE THE SESSION
Log out when the work is done
End the local session explicitly, especially on a shared machine. Logging out removes the active CLI session without changing the IAM user’s console password or permissions.
aws logout --profile local-devAWS DOCUMENTATION