granted-aws

granted.dev's assume gives short-lived AWS creds and console access without plaintext keys on disk. The tool is marketed for SSO, but works for plain IAM users too. First-run fails in three specific ways that no error message explains well - this skill is those three, plus picking the right flow.

Pick the flow from the sign-in URL

The URL you log into decides everything. Check it first:

URL shape	World	Flow
`https://<account-id>.signin.aws.amazon.com/console`	IAM user or root, one account	IAM-user flow
`https://<subdomain>.awsapps.com/start`	IAM Identity Center (SSO)	SSO flow

A gist or doc that opens with granted sso populate assumes the second URL. Running it against the first gets you nowhere - there's no SSO to populate.