Use IAM Identity Center (AWS SSO) with AWS CLI v2 and a reusable sso-session.
Sign in once per day with aws sso login, then switch environments using named profiles.
Point Terraform to profiles via profile the provider or AWS_PROFILE in commands.
Avoid static access keys and routine IAM users for engineers. Short-lived creds reduce risk and ease audits.
Core steps: create sso-session → create one profile per account/role → aws sso login → verify with aws sts get-caller-identity → run Terraform with the right profile.
Safer, faster, and less error-prone when juggling many client accounts.
I was hopping between client accounts that all used AWS Single Sign-On (SSO). The AWS CLI token kept expiring when I switched to a different account. I copied short-term access keys into my terminal to unblock myself. That flow was fragile and risky. One paste to the wrong shell tab could apply Terraform changes to the wrong account. I rebuilt my setup to make SSO the default, keep credentials out of ~/.aws/credentials, and switch accounts safely with named profiles.
