Skip to main content
Fjall authenticates with your AWS accounts using OpenID Connect (OIDC) or AWS IAM Identity Center (SSO). No long-lived access keys are stored, and you never author profiles by hand. Fjall derives them automatically from your organisation config.

​
Prerequisites

  • Fjall CLI installed and logged in (fjall login).
  • At least one AWS account connected, or an organisation deployed.

​
How credentials are derived

Profiles are derived at runtime from your organisation config, which the CLI fetches from the Fjall API. There is no fjall profile command and no manual profile file to edit. Two modes exist: OIDC is preferred whenever an account has its own OIDC role. Otherwise member accounts authenticate via SSO using the root account’s Identity Center.

​
Set up OIDC

OIDC is the default method and requires no manual steps.
  • Organisation mode. Run fjall create organisation. The CLI opens your browser to deploy a CloudFormation stack that creates the OIDC connection for the root account.
  • Account mode, or adding another account. Run fjall connect. This deploys an OIDC CloudFormation stack for that account.
The CLI polls for stack completion, then records the connection. The derived OIDC profile is available immediately.

​
Connect options

​
Set up SSO

If your organisation uses AWS IAM Identity Center, member-account profiles are derived as SSO profiles automatically when you run fjall create organisation. Fjall generates one SSO session per organisation (sso-<rootname>) and an AdministratorAccess profile per member account and region. You do not configure SSO start URLs, account IDs, or role names by hand. See Understanding Profiles for the full derivation model.

​
Verify your setup

In organisation mode, deployments land in the active deployment target. Read the active target:
List every derived target (the active one is marked with ▸):
Switch the active target before deploying:
A deployment target is an account and region pair, named <accountname>-<regionabbrev>. In account mode with a single connected account, Fjall selects the target for you.

​
Next Steps

Understanding Profiles

How Fjall derives OIDC and SSO profiles

Deploy Organisation

Create and deploy your AWS organisation

Connect an AWS Account

Add or recover an AWS account connection

Deploy an Application

Ship your first application to AWS