litellm with sso account instance type

The blueprint requires an Organization instance of IAM Identity Center. It will not work with an Account instance for SSO-based access. Here is why.

The authentication flow in this blueprint is:

1. Developer runs aws sso login with a profile that references a permission set (sso_role_name = ClaudeCodeUser).
2. SSO issues temporary IAM credentials for that role.
3. The apiKeyHelper script uses those credentials to make a SigV4-signed request to the Token Service (API Gateway with IAM Auth).
4. Token Service validates the caller identity and returns a LiteLLM Virtual Key.
5. Claude Code uses the Virtual Key to call the LLM Gateway (ALB to ECS/LiteLLM to Bedrock).

The critical dependency is step 1. Permission sets are what map an Identity Center user to an IAM role in a specific account. Without a permission set, aws sso login has no role to assume, which means no temporary credentials are issued, and the entire chain breaks.

Account instances cannot create or assign permission sets. Permission sets are an Organization-level feature that requires AWS Organizations integration with Identity Center.

Your options:

1. Enable an Organization instance. If you have access to AWS Organizations (even a single-account org), you can enable the Organization instance of Identity Center. This gives you permission set capabilities. This is the intended deployment model.

2. Continue using the self-signed/direct credentials method. This bypasses SSO entirely. You authenticate Claude Code with static IAM credentials or instance profile credentials rather than the SSO flow.

3. Modify the Token Service auth. You could replace the API Gateway IAM Auth with a different mechanism (e.g., Cognito User Pool authorizer that federates with your Account instance users). This requires modifying the CDK code in lib/stacks/auth-stack.ts and the Lambda handler, and is a non-trivial change that deviates from the blueprint's design.

References:

• IAM Identity Center instance types: https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html
• Claude Code LLM Gateway docs: https://docs.anthropic.com/en/docs/claude-code/llm-gateway