Start here

Getting started

Frost needs two pieces of information — your AWS access portal URL and the region your Identity Center lives in. Everything else it works out from the AWS SSO API.

1. Install Frost

Grab the build for your platform from the downloads page. There is no installer to configure and no account to create.

• macOS — unzip and drag Frost.app into /Applications. The app is signed and notarized by Apple.
• Windows — run the .exe installer. It is not code-signed, so SmartScreen warns on first run: choose More info → Run anyway.
• Linux — unzip anywhere and run the Frost binary inside.

Frost has no window of its own at startup. Once it is running you will find a snowflake in the menu bar (macOS) or the notification area (Windows and Linux). See platforms & updates for how each build updates itself.

2. Connect it to your access portal

Open the tray menu and choose Get Started. That opens the settings window on the Login page, which wants two things:

• SSO Start URL — your AWS access portal URL, usually https://d-xxxxxxxxxx.awsapps.com/start or https://your-company.awsapps.com/start. Custom access portal domains work too.
• AWS Region — the region your IAM Identity Center instance lives in. This is not necessarily where your workloads run; it is the region shown next to your Identity Center instance in the AWS console.

Press Save & Refresh. Frost validates both values, stores them, discards any existing token, and starts a refresh immediately. See login settings for the validation rules and what to do if you are not sure which region to pick.

3. Sign in once

Frost registers itself as an OAuth client with AWS and opens the access portal sign-in page — by default in a small Frost window, and optionally in your default browser instead (behavior settings). Approve the request the way you normally would: password, MFA, security key, passkey, or your company's identity provider.

AWS tells you to close the window once you have approved. Do that; Frost collects the token on its next poll.

4. What Frost does next

The rest of a refresh run is automatic, and takes a few seconds to a minute depending on how many accounts you can reach:

1. Token The SSO access token is stored, and written to the cache file the AWS CLI reads — which is what makes aws --profile … work without a separate aws sso login.
2. Profiles Frost lists every account you can access and every permission set in each, generates a profile name for each pair, and merges those profiles into ~/.aws/config. Anything else in that file is left exactly as it was.
3. EKS Using those profiles, Frost lists every AWS region and looks for EKS clusters in each. Clusters it can describe are written to ~/.kube/config as ready-to-use kubectl contexts.

Open Credentials to see the token status and the accounts you can reach, EKS for the clusters that were found, and Activity for the run itself, step by step.

5. Use the profiles

Profile names are generated from the account name and the permission set name, so they are predictable and the same for everyone on your team:

$ aws --profile acme-production-administratoraccess s3 ls
$ AWS_PROFILE=acme-testing-poweruseraccess terraform plan

$ kubectl config get-contexts -o name
production
staging

The Credentials page lists every profile name Frost wrote; expand an account to see the permission set → profile name mapping. If those names are longer than you would like, profile names explains how to shorten them by renaming your AWS accounts.

After that, nothing

Frost schedules the next refresh for the moment the current token expires — typically about eight hours out — and starts with your machine, so in steady state there is nothing to do. When the token does expire you either see the login page appear, or a notification inviting you to press the refresh hotkey, depending on which authentication mode you chose.