AWS connection guide

Make AWS sessions last longer.

For StageBeacon 0.1.1 and later

StageBeacon automatically renews temporary AWS credentials before they expire. Renewal works while your underlying AWS IAM Identity Center session remains valid. When that session ends, AWS requires a new interactive sign-in.

Recommended setup: longer organization session duration, StageBeacon's built-in browser sign-in or a refreshable sso-session profile, desktop notifications, and service-side CodePipeline alerts for critical pipelines.

1. Extend IAM Identity Center session duration

Open AWS IAM Identity Center as an administrator.
Choose Settings → Authentication.
Choose Configure beside User interactive sessions.
Choose an organization-approved duration. AWS supports 15 minutes through 90 days.
Open Permission sets and select the permission set used by StageBeacon.
Set its AWS account session duration, up to 12 hours.
Sign out and sign in again. New duration applies only to new sessions.

External identity-provider policy can impose a shorter session. Role chaining is also limited to one hour, so avoid chained-role profiles for long-running StageBeacon monitoring.

2. Sign in without AWS CLI

On a fresh macOS or Linux installation, open StageBeacon, add an AWS monitor, and choose Sign in with AWS. Enter the access portal URL and IAM Identity Center Region supplied by your AWS administrator. StageBeacon opens AWS in your browser, then discovers the accounts and permission sets assigned to you.

Choose the account, permission set, and CodePipeline Region. StageBeacon stores the refreshable session in macOS Keychain or Linux Secret Service; it never requests your AWS password.

3. Optional: reuse an AWS CLI profile

If you already use AWS CLI v2, StageBeacon can reuse a named sso-session section:

[profile stagebeacon]
sso_session = company
sso_account_id = 123456789012
sso_role_name = Developer
region = eu-central-1

[sso-session company]
sso_start_url = https://company.awsapps.com/start
sso_region = eu-central-1
sso_registration_scopes = sso:account:access

Then create and validate the session:

aws configure sso --profile stagebeacon
aws sso login --profile stagebeacon
aws sts get-caller-identity --profile stagebeacon

Do not export temporary AWS access keys for StageBeacon. Exported credentials cannot refresh automatically.

4. Connect StageBeacon with a profile

Open StageBeacon Settings.
Add or edit an AWS CodePipeline monitor.
Select your refreshable AWS profile.
Choose Sign in and complete IAM Identity Center authorization.
Enable StageBeacon desktop notifications.
Enable automatic startup for monitoring after restart.

What StageBeacon 0.1.3 improves

Signs in from a clean macOS or Linux installation without AWS CLI.
Discovers assigned AWS accounts and permission sets after browser authorization.
Refreshes IAM Identity Center access tokens five minutes before expiry.
Retries once when AWS rejects a stale access token.
Keeps your last successful pipeline snapshot visible.
Shows an explicit AWS session-expired state instead of silent missing progress.
Sends one local alert when monitoring pauses because the session expired.
Opens Settings from that alert so you can reconnect immediately.

5. Add independent pipeline notifications

For production-critical pipelines, create an Amazon EventBridge rule for CodePipeline execution state changes and route it to Amazon SNS, email, SMS, Lambda, or an approved chat target. These alerts run inside AWS and do not depend on StageBeacon, a browser tab, or your desktop session.

Official AWS documentation

Need help? Email support@stagebeacon.io.