How Frost works

The ~/.aws/config file

Frost doesn't own your ~/.aws/config — it owns the profiles it wrote there. Everything else in the file survives every refresh, byte for byte.

The ownership marker

Every profile Frost writes carries a comment line directly under its header:

[profile main-admin]
# frost:managed - Frost updates and removes this profile. Delete this line to take it over.
sso_start_url  = https://acme.awsapps.com/start
sso_region     = us-east-1
sso_account_id = 111111111111
sso_role_name  = AdministratorAccess
region         = us-east-1
output         = json

That marker is the whole ownership model. On every refresh Frost rewrites the sections carrying it, removes the ones whose account or permission set has gone away in Identity Center, and leaves every other line in the file exactly as it found it.

What is preserved

The file is merged, never rewritten wholesale. It is shared with the AWS CLI and with whatever you have put there by hand, so everything below survives untouched:

• your [default] profile;
• hand-written [profile …] sections;
• [sso-session …] and [services …] sections;
• comments, including their exact position — a comment written directly above a section header travels with that section, so removing a profile does not eat the note about the next one;
• blank-line placement, and the file's line endings (a CRLF file stays CRLF).

When a merge produces exactly what is already on disk, Frost skips the write altogether.

How the file is written

This file is shared, so the write is careful about more than its contents:

• Atomically. The new contents are written and flushed to disk before replacing the old ones, so an interrupted run cannot leave a truncated ~/.aws/config behind — the file is either the old version or the new one.
• Keeping your permissions. Whatever mode the file already has is what it keeps. If you tightened ~/.aws/config to 0600, it stays 0600; a file Frost has to create from nothing starts at 0600.
• Keeping your symlink. If the file is a symlink — into a dotfiles repository, say — the link survives and the file it points at is what changes, along with that file's own permissions.
• Retrying on Windows. Windows refuses to replace a file while another process holds it open; the write backs off and retries briefly rather than failing the refresh.

~/.kube/config is written the same way. EKS discovery →

Profiles you wrote yourself

If one of your own profiles happens to have the same name as one Frost would generate, yours wins. Frost leaves it alone, skips writing its own, and logs a warning. Nothing you wrote is ever overwritten by a generated profile.

The practical consequence: that account/permission set pair no longer tracks Identity Center. If that is not what you wanted, rename your profile (or give the AWS account a #short-name that steers the generated name elsewhere — see profile names).

Upgrading from older versions

Older versions of Frost rewrote ~/.aws/config wholesale and wrote no marker. On the first refresh after upgrading, an unmarked profile whose name and full contents are exactly what Frost would generate today is adopted: the marker is added and the profile continues to be managed. Without that, the upgrade would add a second copy of every profile.

Adoption compares the complete key set, so a profile that has drifted — an extra key, a different region — is not adopted. It is treated as yours, per the previous section.

When profiles disappear

Losing access to an account, or having a permission set revoked, removes the corresponding marked profiles at the next refresh. That is the point of the marker: your config file tracks your actual access rather than accumulating profiles that no longer work.

To keep such a profile around anyway, delete its marker line before the next refresh.

Using the profiles elsewhere

Alongside the profiles, Frost writes the SSO access token into ~/.aws/sso/cache/ in the format the AWS CLI and the AWS SDKs expect. That is what makes this work with no further setup:

$ aws --profile prod-admin sts get-caller-identity
$ AWS_PROFILE=prod-admin terraform apply
$ aws --profile test-poweruser s3 ls

No aws sso login, and no AWS CLI installation required for Frost itself — it talks to AWS through its own SDK. See files & locations for exactly what is written where.

A note for Windows

On Windows the file is %UserProfile%\.aws\config. An AWS CLI command reading it, or an antivirus scanner looking at it, can block the replacement for a moment; the write retries before giving up, and a refresh that still fails says so on the Credentials page.