Getting SSO login arn and expiration

[bytebeast]

Been trying to figure out how to get the current creds used on my terminal window. So that I can place that in my PROMPT. I am able to run aws sts get-caller-identity but that can take up to 3 seconds to run ( that is a long pause between terminal prompts ).

Before we used sso, I could just look at AWS_PROFILE variable to tell what that was being used. Is there a way to get this information? Or can the cli add AWS_SSO_ARN and AWS_SSO_EXPIRATION ( with timestamp of when it expires )?

[uldyssian-sh]

You can get this without calling STS every time.

For SSO profiles, AWS CLI caches the SSO access token locally under:

~/.aws/sso/cache/

Those cache files are JSON and include an expiresAt timestamp. You can read that timestamp directly (fast, local file read) and use it in your prompt.

Example (bash) to print the soonest-expiring SSO token expiry:

ls -1 ~/.aws/sso/cache/.json >/dev/null 2>&1 &&
jq -r '.expiresAt // empty' ~/.aws/sso/cache/.json 2>/dev/null | sort | head -n1

If you also want the “who am I” ARN without the 2–3s STS call, there is no built-in environment variable that AWS CLI exports (like AWS_SSO_ARN) because the caller identity is not derived purely from the local token; it’s resolved by AWS services (STS).

Practical prompt approach:

Use AWS_PROFILE (or AWS_DEFAULT_PROFILE) to show which profile is selected, and use the local SSO cache expiresAt to show whether the login is still valid.

export AWS_PROFILE=my-sso-profile

Then in your prompt:

• show $AWS_PROFILE (instant)
• show the cached token expiry from ~/.aws/sso/cache (instant)

If you need ARN, the only authoritative method is an API call like aws sts get-caller-identity, but you can run it less frequently (e.g., once per session, or cache it in a temp file) instead of on every prompt render.

Summary:

• Expiration can be read locally from ~/.aws/sso/cache/*.json (expiresAt)
• AWS CLI does not expose AWS_SSO_ARN / AWS_SSO_EXPIRATION env vars
• Use profile name + local cache expiry for a fast prompt, and optionally refresh/cached STS identity periodically

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.