AWS CLI Credentials Setup: Configure, Verify, and Secure Access

Originally published on 2015-10-27; fully revised and updated.

This guide explains how to set up AWS credentials for the AWS CLI, verify that access works, and choose the right credential method for local work and automation.

Install and verify the AWS CLI

If the AWS CLI is not installed yet, follow your platform-specific installation steps. After install, verify the CLI is available in your shell:

aws --version
aws help

Configure credentials with aws configure

Get an access key ID, secret access key, and preferred default region from your AWS account setup (commonly via IAM). Then run:

aws configure
AWS Access Key ID [None]: YOUR_ACCESS_KEY_ID
AWS Secret Access Key [None]: YOUR_SECRET_ACCESS_KEY
Default region name [None]: us-east-1
Default output format [None]: jsonCode language: CSS (css)

Quick validation commands:

aws sts get-caller-identity
aws s3 lsCode language: JavaScript (javascript)

Where AWS CLI stores credentials and config

By default, AWS CLI stores secrets and settings in separate files. On Linux/macOS/Unix: ~/.aws/credentials and ~/.aws/config. On Windows: C:\Users\USERNAME\.aws\credentials and C:\Users\USERNAME\.aws\config.

cat ~/.aws/credentials
cat ~/.aws/config

# Example ~/.aws/credentials
[default]
aws_access_key_id = YOUR_ACCESS_KEY_ID
aws_secret_access_key = YOUR_SECRET_ACCESS_KEY

# Example ~/.aws/config
[default]
region = us-east-1
output = jsonCode language: PHP (php)

Credential methods compared

Use environment variables when needed

Environment variables override file-based configuration in many workflows and are common in CI/CD. Example for a Unix-like shell:

export AWS_ACCESS_KEY_ID="YOUR_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="YOUR_SECRET_ACCESS_KEY"
export AWS_DEFAULT_REGION="us-east-1"

aws sts get-caller-identity

# Clear variables after use
unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGIONCode language: JavaScript (javascript)

Credential setup workflow

flowchart TD
    A[Install AWS CLI] --> B[Run aws help]
    B --> C[Create or get access key]
    C --> D[Run aws configure]
    D --> E[Credentials and config files saved]
    E --> F[Run sts get caller identity]
    F --> G{Access works}
    G -- yes --> H[Run AWS service commands]
    G -- no --> I[Check profile region and IAM permissions]
    I --> F

Validate and troubleshoot

aws configure list
aws sts get-caller-identity --profile default
aws ec2 describe-instances --region us-west-2 --output tableCode language: PHP (php)

If commands fail, check the active profile, configured region, and IAM permissions for the identity being used.

Common pitfalls and best practices

• Never commit ~/.aws/credentials or raw keys to Git.
• Use named profiles instead of constantly overwriting the default profile.
• Prefer role-based access for compute workloads to avoid long-lived static keys.
• Use least-privilege IAM policies and rotate keys regularly.
• Validate identity early with aws sts get-caller-identity before running destructive commands.

References

• DevOpsSchool tutorial: Install and configure AWS CLI
• AWS CLI User Guide: Installing
• AWS CLI User Guide: Getting started
• Original article permalink

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.