How Frost works

Profile names

Every account and permission set combination you can reach becomes a profile in ~/.aws/config. The names are generated, deterministic, and identical for everyone on your team.

The rule

A profile name is the account part and the permission set part, joined by a hyphen and lower-cased:

# account name              permission set        profile name
ACME Production          AdministratorAccess   acme-production-administratoraccess
ACME Testing             PowerUserAccess       acme-testing-poweruseraccess

Each part is slugified — spaces become hyphens, punctuation is dropped, everything is lower-cased — so the result is safe to type, to put in a script, and to use as AWS_PROFILE.

Because both halves come from AWS rather than from local configuration, everyone on your team gets the same names without coordinating anything. A runbook that says --profile prod-admin works on every machine.

Shortening the account part

Account names are usually written for humans, not for command lines. Add a #short-name marker anywhere in the AWS account name and Frost uses that instead of the slugified name:

The marker is # followed by letters, digits, hyphens or underscores, and the first one in the name wins. Renaming an account is done in AWS Organizations — see the AWS guide to changing an account name — and takes effect on everyone's machine at their next refresh.

Shortening the permission set part

Custom permission sets are slugified as they are, so the best way to get short profile names is to give them short names in Identity Center. For the AWS-managed permission sets, which you cannot rename, Frost applies a built-in shorthand:

The profile still points at the real permission set — only the name is shortened. sso_role_name in ~/.aws/config keeps the original value.

Both together

Pinning a region per account

Profiles get region set to your Identity Center region by default. When an account's workloads live somewhere else, add an @region marker to the account name and Frost writes that region into every profile for that account instead:

# AWS account name: ACME Testing (#test @eu-west-1)

[profile test-poweruser]
sso_start_url  = https://acme.awsapps.com/start
sso_region     = us-east-1
sso_account_id = 222222222222
sso_role_name  = PowerUserAccess
region         = eu-west-1
output         = json

With that in place, aws --profile test-poweruser … and any SDK using the profile target eu-west-1 without --region on every call. sso_region is untouched: it still points at the Identity Center instance.

What lands in the file

Every generated profile has exactly six keys:

These are the legacy-style SSO profile keys rather than an [sso-session] block, which is what lets Frost keep the token cache in the format the AWS CLI expects without you running aws sso login. Each profile is written with a marker comment that tells Frost it owns that section — see the ~/.aws/config file.

Name collisions

Two accounts that slugify to the same account part — or that carry the same #short-name — produce colliding profile names, and only one of them can win. If a profile you expected is missing, check for a duplicate short name first; the Credentials page lists every account with the profile names generated for it, which makes the clash easy to spot.

A profile you wrote yourself always wins over a generated one of the same name: Frost skips its own rather than overwriting yours.