{"id":453,"date":"2026-10-14T12:11:37","date_gmt":"2026-10-14T12:11:37","guid":{"rendered":"http:\/\/www.scmgalaxy.com\/tutorials\/2015\/10\/27\/setup-aws-credentails-using-aws-command-line-interface\/"},"modified":"2026-10-14T12:11:37","modified_gmt":"2026-10-14T12:11:37","slug":"setup-aws-credentials-using-aws-command-line-interface","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/setup-aws-credentials-using-aws-command-line-interface\/","title":{"rendered":"AWS CLI Credentials Setup: Configure, Verify, and Secure Access"},"content":{"rendered":"\n

Originally published on 2015-10-27; fully revised and updated.<\/em><\/p>\n\n\n\n

This guide explains how to set up AWS credentials for the AWS CLI, verify that access works, and choose the right credential method for local work and automation.<\/p>\n\n\n\n

\"Setup<\/figure>\n\n\n\n

Install and verify the AWS CLI<\/h2>\n\n\n\n

If the AWS CLI is not installed yet, follow your platform-specific installation steps. After install, verify the CLI is available in your shell:<\/p>\n\n\n

aws --version\naws help<\/code><\/span><\/pre>\n\n\n
Configure credentials with aws configure<\/h2>\n\n\n\n
Get an access key ID, secret access key, and preferred default region from your AWS account setup (commonly via IAM). Then run:<\/p>\n\n\n
aws<\/span> configure<\/span>\nAWS<\/span> Access<\/span> Key<\/span> ID<\/span> [None]<\/span>: YOUR_ACCESS_KEY_ID<\/span>\nAWS<\/span> Secret<\/span> Access<\/span> Key<\/span> [None]<\/span>: YOUR_SECRET_ACCESS_KEY<\/span>\nDefault<\/span> region<\/span> name<\/span> [None]<\/span>: us-east-1<\/span>\nDefault<\/span> output<\/span> format<\/span> [None]<\/span>: json<\/span><\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Quick validation commands:<\/p>\n\n\n
aws sts get<\/span>-caller-identity\naws s3 ls<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Where AWS CLI stores credentials and config<\/h2>\n\n\n\n
By default, AWS CLI stores secrets and settings in separate files. On Linux\/macOS\/Unix: ~\/.aws\/credentials<\/code> and ~\/.aws\/config<\/code>. On Windows: C:\\Users\\USERNAME\\.aws\\credentials<\/code> and C:\\Users\\USERNAME\\.aws\\config<\/code>.<\/p>\n\n\n
cat ~\/.aws\/credentials\ncat ~\/.aws\/config\n\n# Example ~\/.aws\/credentials<\/span>\n[default<\/span>]\naws_access_key_id = YOUR_ACCESS_KEY_ID\naws_secret_access_key = YOUR_SECRET_ACCESS_KEY\n\n# Example ~\/.aws\/config<\/span>\n[default<\/span>]\nregion = us-east-1<\/span>\noutput = json<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Credential methods compared<\/h2>\n\n\n\n
Method<\/th>Where secrets live<\/th>Best for<\/th>Example<\/th><\/tr><\/thead>
aws configure<\/code> default profile<\/td>~\/.aws\/credentials<\/code><\/td>Simple single-account local setup<\/td>aws configure<\/code><\/td><\/tr>
Named profile<\/td>~\/.aws\/credentials<\/code> under profile name<\/td>Multiple AWS accounts\/environments<\/td>aws configure --profile dev<\/code><\/td><\/tr>
Environment variables<\/td>Shell\/process environment<\/td>CI jobs and short-lived sessions<\/td>export AWS_ACCESS_KEY_ID=...<\/code><\/td><\/tr>
Instance or workload role<\/td>No static key in local files<\/td>EC2, ECS, EKS runtime access<\/td>CLI uses attached role credentials automatically<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Use environment variables when needed<\/h2>\n\n\n\n
Environment variables override file-based configuration in many workflows and are common in CI\/CD. Example for a Unix-like shell:<\/p>\n\n\n
export<\/span> AWS_ACCESS_KEY_ID=\"YOUR_ACCESS_KEY_ID\"<\/span>\nexport<\/span> AWS_SECRET_ACCESS_KEY=\"YOUR_SECRET_ACCESS_KEY\"<\/span>\nexport<\/span> AWS_DEFAULT_REGION=\"us-east-1\"<\/span>\n\naws sts get<\/span>-caller-identity\n\n# Clear variables after use\nunset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Credential setup workflow<\/h2>\n\n\n\n
\nflowchart TD\n    A[Install AWS CLI] --> B[Run aws help]\n    B --> C[Create or get access key]\n    C --> D[Run aws configure]\n    D --> E[Credentials and config files saved]\n    E --> F[Run sts get caller identity]\n    F --> G{Access works}\n    G -- yes --> H[Run AWS service commands]\n    G -- no --> I[Check profile region and IAM permissions]\n    I --> F\n<\/pre>\n\n\n\n
Validate and troubleshoot<\/h2>\n\n\n
aws configure list<\/span>\naws sts get-caller-identity --profile default<\/span>\naws ec2 describe-instances --region us-west-2<\/span> --output table<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
If commands fail, check the active profile, configured region, and IAM permissions for the identity being used.<\/p>\n\n\n\n
Common pitfalls and best practices<\/h2>\n\n\n\n