Settings
Login settings
Two fields, and the only ones Frost genuinely requires. Everything else it discovers from AWS.
SSO Start URL
Your organisation's AWS access portal URL — the page you would otherwise bookmark to pick an account and role. It usually looks like one of:
https://d-1234567890.awsapps.com/start
https://acme.awsapps.com/start
https://aws.acme.com/start # a custom access portal domain
You can find it in the IAM Identity Center console under
Settings → Identity Center instance, or in the email your
administrator sent when your access was set up. If a colleague already
uses Frost or the AWS CLI, the value is the sso_start_url in
their ~/.aws/config.
Frost checks that it is a valid https:// URL with a hostname before storing it:
| If you enter | Frost says |
|---|---|
| nothing | Enter your AWS access portal URL. |
| something that is not a URL | That start URL isn't a valid URL. |
http://… | The start URL has to begin with https://. |
| a URL with no host | The start URL is missing a hostname. |
Custom domains are deliberately accepted — Identity Center supports
custom access portal domains, and rejecting anything that is not
*.awsapps.com would lock out the organisations that use one.
AWS Region
The region your IAM Identity Center instance lives in. This is not where your workloads run, and not necessarily where you spend your day — it is the region shown next to your Identity Center instance in the AWS console, and it is where Frost sends its sign-in and account-listing calls.
Ways to find it:
- the IAM Identity Center console shows the instance's region in the region picker;
sso_regionin a colleague's~/.aws/config;- the region embedded in the sign-in URL you are redirected to when using the access portal.
The dropdown carries the commercial regions plus GovCloud. If your region is not listed but is already stored — Frost keeps whatever was saved before — it is shown as an extra entry so you do not lose it by opening the page.
Getting the region wrong is the most common setup mistake. The symptom is a token step that fails with an AWS error naming an endpoint or an unknown client, since a client registered in one region means nothing in another. Troubleshooting →
This region versus profile regions
The region here becomes sso_region in every generated
profile, and also the default region for them. If some
accounts work in a different region, you do not change this setting —
you mark those accounts with an @region in their AWS account
name and Frost writes that region into their profiles instead.
Profile names →
What saving does
Save & Refresh validates both fields, stores them, deletes the current access token and starts a refresh immediately — which means a sign-in, since there is no longer a token to reuse.
The tray menu updates at the same moment: before Frost is configured it offers Get Started, and afterwards Settings… plus Refresh now.
Changing the start URL does not clean up profiles written for the old one. They carry Frost's marker, so the first refresh against the new portal rewrites the ones that still exist and removes those that no longer do. The config file →
Editing safely
The page updates itself from Frost's state — except while you are typing. Once you change either field, incoming updates leave the form alone until you save, so a refresh finishing in the background cannot revert an edit halfway through.