OK, this is not good, I may have dozens of accounts, so this is going to make this so inconvenient again, just like before, to where the cons outweigh the pros. I went into the CLI, confirmed the profile worked, then once at least one CLI command was run against the profile (note I was never prompted for another aws sso login command on the CLI once the first one was done) on the CLI, Cyberduck would then work against that profile. But when I next tried to double-click these profiles, they would all hang. So, I then went in and setup a bunch of other bookmarks based on other SSO profiles.

I was glad to see this appeared to make Cyberduck usable again for large-scale / enterprise-level AWS multi-account scenarios! I figured, just as with the command line, I needed to first run 'aws sso login -profile $profile', which I did, then also confirmed on the same CLI I could see data using a simple command like 'aws ec2 describe-regions -profile $profile', so when I went back into Cyberduck and then clicked on the bookmark, it worked.

For the first account, I added the bookmark, specified the profile name (based on SSO), and then double-clicked to open - nothing. I decided to try it again today, and noticed the new credentials option to obtain credentials from ~/.aws/config, where I have a bunch of SSO based credentials setup for many accounts organized via AWS Control Tower.

I stopped using Cyberduck a couple years ago as multi-account became increasingly common, and I moved to use of aws-vault to store credentials in the MacOS or Windows keychain or use AWS SSO (pre-control tower), neither of which worked with Cyberduck, making it increasingly difficult to use without keeping a duplicate set of credentials.

Aws cyberduck