# SSO and Cross-Account Access
## AWS SSO / IAM Identity Center
The AWS SDK uses the default credential provider chain, which includes SSO:
1. **Log in**:
```bash
aws sso login --profile my-sso-profile
```
2. **Use the profile** via environment:
```bash
export AWS_PROFILE=my-sso-profile
```
Or in your MCP client config:
```json
{
"mcpServers": {
"aws-mcp": {
"command": "node",
"args": ["/path/to/dist/index.js"],
"env": {
"AWS_PROFILE": "my-sso-profile",
"AWS_REGION": "us-east-1"
}
}
}
}
```
## Cross-Account (Assume Role)
### Option 1: AWS Profile with Role
Configure `~/.aws/config`:
```ini
[profile my-cross-account]
role_arn = arn:aws:iam::123456789012:role/ReadOnlyRole
source_profile = default
```
Then use `AWS_PROFILE=my-cross-account`.
### Option 2: SSO + Assume Role
```ini
[profile my-sso-role]
sso_session = my-sso
sso_account_id = 123456789012
sso_role_name = ReadOnlyRole
region = us-east-1
```
### Option 3: Config File (mcp-config.json)
If using assume-role helpers, set:
```json
{
"assumeRole": {
"roleArn": "arn:aws:iam::123456789012:role/ReadOnlyRole",
"externalId": "optional-external-id",
"sessionName": "mcp-aws-session"
}
}
```
Then run with credentials that can assume this role (e.g. SSO profile or base IAM user).
