Frost
Free & open source · Apache 2.0

AWS Credentials,
Automatically Refreshed.

Frost is a desktop app that takes the friction out of AWS Identity Center. Give it your start URL — it handles the logins, writes a tidy ~/.aws/config, and even finds your EKS clusters along the way.

Downloadlatest release View source

Available for macOS, Windows & Linux · Intel, Apple Silicon and ARM64

Credentials stay fresh, in the background

No more typing aws sso login mid-task. Frost watches your session from the menu bar and refreshes it before it expires — so your shell, scripts, and long-running jobs can keep working.

without Frost 
$ aws s3 sync ./build s3://prod
upload: build/page-001.html
... time passes ...
upload: build/page-942.html
An error occurred (ExpiredToken)
$ aws sso login
$ aws s3 sync ./build s3://prod  # start over
with Frost 
$ aws s3 sync ./build s3://prod
upload: build/page-001.html
... time passes ...
upload: build/page-942.html
... credentials refresh silently ...
upload: build/page-1827.html
✓ done

How a refresh works, step by step →

Everything in one window

Frost lives in your menu bar, but it isn't a black box. A native settings window lets you set things up once, then see exactly what happened on every refresh.

Set it up once

Paste your start URL, pick a region from the list, and you're done. No prompts interrupting you later, no config files to hand-edit.

Refresh from anywhere

A global hotkey — ⌘⇧R by default, and rebindable — triggers a refresh or opens the login browser without leaving what you're doing. Prefer a nudge instead? Frost can notify you rather than refreshing on its own.

See every run

The Activity page keeps a log of recent refreshes. Open any run to see each step — token, profiles, EKS discovery — with the accounts and clusters it found, and the exact error if something failed.

Private by design

Everything stays on your machine. No backend, no analytics, no telemetry, no crash reporting. You choose how long run history is kept, and you can erase it at any time.

A tour of the app window and tray →

Every setting, with its default →

Predictable profile names

Frost writes a profile to ~/.aws/config for every account + permission set combination. Names are deterministic — built from the account and the permission set, joined by a hyphen. Frost marks the profiles it writes and leaves the rest of the file — [default] included — alone. 

# ~/.aws/config — the profiles Frost manages

[profile acme-main-administratoraccess]
sso_account_id = 111111111111
sso_role_name  = AdministratorAccess

[profile acme-main-poweruseraccess]
sso_account_id = 111111111111
sso_role_name  = PowerUserAccess

[profile acme-testing-poweruseraccess]
sso_account_id = 222222222222
sso_role_name  = PowerUserAccess

[profile acme-testing-billingaccess]
sso_account_id = 222222222222
sso_role_name  = BillingAccess

[profile acme-production-administratoraccess]
sso_account_id = 333333333333
sso_role_name  = AdministratorAccess

[profile acme-production-poweruseraccess]
sso_account_id = 333333333333
sso_role_name  = PowerUserAccess
Three optional knobs make these names even tighter.

1Shorter account names with #short-name

Rename your AWS accounts to include a short alias, e.g. ACME Main (#main). Frost will use the short alias when generating profile names. 

# ~/.aws/config — after adding #short-name aliases

[profile main-administratoraccess]
sso_account_id = 111111111111
sso_role_name  = AdministratorAccess

[profile test-poweruseraccess]
sso_account_id = 222222222222
sso_role_name  = PowerUserAccess

[profile prod-administratoraccess]
sso_account_id = 333333333333
sso_role_name  = AdministratorAccess

# ...the account part is now just your short alias

2Built-in permission set shorthands

Frost also shortens the standard AWS-managed permission set names automatically.

AdministratorAccessadmin
Billingbilling
DatabaseAdministratordba
DataScientistdatasci
NetworkAdministratornetadmin
PowerUserAccesspoweruser
SecurityAuditsecaudit
SupportUsersupport
SystemAdministratorsysadmin
ViewOnlyAccessviewonly

3Per-account default region

If an account belongs in a different region than your Identity Center, add @region to the account name. For example, ACME Testing (#test @eu-west-1) tells Frost to write region = eu-west-1 for that account's profiles — so you can drop --region from your CLI calls. 

# ~/.aws/config
[profile test-poweruser]
sso_start_url  = https://acme.awsapps.com/start
sso_region     = us-east-1
sso_account_id = 123456789012
sso_role_name  = PowerUserAccess
region         = eu-west-1

Bring it together

The same account & permission set, all three knobs applied:

default acme-production-administratoraccess
+ #prod prod-administratoraccess
+ shorthand prod-admin

The full naming rules, including per-account regions →

What Frost owns in ~/.aws/config — and what it never touches →

EKS clusters, ready for kubectl

On every credential refresh, Frost scans your accounts for EKS clusters and keeps ~/.kube/config in sync — automatically. New clusters appear in kubectl without any setup steps.

Automatic discovery

Frost lists every AWS region and tries eks:ListClusters with each detected profile. Successful calls land in your kubeconfig; the rest are silently ignored.

Batteries included

Authentication uses a bundled copy of AWS IAM Authenticator, so kubectl works straight out of the box.

The same names for everyone on your team

Context names are derived deterministically from cluster info, so every teammate ends up with the same names in their kubeconfig. Scripts, runbooks, and CI rules can reference clusters by short, predictable names — no per-developer ARNs or aliases to coordinate.

kubectl 
$ kubectl config get-contexts -o name
production
staging
analytics

# a script anyone on the team can run, unchanged
$ kubectl --context production rollout restart deploy/api
deployment.apps/api restarted

When clusters share a name across regions, accounts, or roles, Frost adds back only what's required to tell them apart — for example, production:eu-west-1.

How the scan works and how contexts are named →

About the bundled AWS IAM Authenticator →

Documentation

A page for every feature, every setting, and every file Frost touches on your disk — plus the fixes for the things that usually go wrong.

Getting started Install Frost, connect it to your access portal, and see what the first refresh does. Credential refresh When Frost refreshes, how the token is obtained, and what each run writes. Signing in The login window, the default-browser mode, security keys and passkeys. Profile names How accounts and permission sets become profile names — and how to shorten them. EKS discovery The region scan, the kubeconfig merge, and how contexts are named. Bundled IAM authenticator The helper that lets kubectl reach EKS without the AWS CLI. Settings Every setting, its default, and what changing it does. Security & privacy What is stored, where, and what never leaves your machine. Troubleshooting Failed refreshes, missing notifications, kubectl auth errors.

Browse all documentation →

Downloadlatest release View source