How are people managing their AWS creds when running agent-deck?

[jamisonbryant]

I know there's a zillion ways to log into AWS, my team is using aws-sso-util and awsume. I run aws-sso-util to log into the SSO, then awsume -l to list out the roles I have access to, then finally I pick one and I'm authenticated.

In order for Claude (or any AI) to send commands like 'aws s3 ls' they have to have credentials. Normally I would Ctrl+Z Claude, log in, and 'fg' to resume, but that was before I was using agent-deck.

Do I keep using my Ctrl+Z trick, or is there a better way?

[asheshgoplani]

Hey @jamisonbryant, good question! This is a common challenge with tmux-based workflows.

The Core Issue

AWS credentials work via environment variables OR files (~/.aws/credentials, ~/.aws/sso/cache/). The problem with awsume is that by default it sets environment variables in your current shell, which won't propagate to already-running tmux sessions.

Options

Option 1: Pre-authenticate before starting agent-deck

awsume <role>
agent-deck

New sessions created after auth will inherit the environment. Simple but requires planning ahead.

Option 2: Use awsume's credential file mode

Configure awsume to write to ~/.aws/credentials instead of using env vars:

awsume <role> --credentials-file
# or set as default in ~/.awsume/config.yaml:
# credentials_file: true

File-based credentials work in ALL terminals, regardless of when they were started.

Option 3: Detach → Auth → Reattach

When you need to re-auth mid-session:

1. Ctrl+b d (detach from tmux, returns you to your original shell)
2. awsume <role>
3. agent-deck (reattach)

The auth won't propagate to the existing Claude process, but you can restart the session (r key) to pick up the new credentials.

Option 4: Use AWS SSO login directly

If your setup supports it:

aws sso login --profile <profile>

This writes to ~/.aws/sso/cache/ (file-based), so it works everywhere without environment variables.

Option 5: Split pane for auth (tmux trick)

While attached to a session:

1. Ctrl+b % (split pane vertically)
2. Run your auth commands in the new pane
3. Ctrl+b x (close the auth pane when done)

The Claude session can use file-based credentials immediately.

My Recommendation

Option 2 (credential file mode) is the cleanest long-term solution. Once you configure awsume to write to the credentials file, auth "just works" everywhere.

Hope that helps! Let me know if you have questions about any of these approaches.