# [[AWS Auth]] ## AWS cli config profiles and auth The aws cli references [named profiles](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) defined in `config` (`~/.aws/config`) and `credentials` (`./aws/credentials`). You "activate" a profile by setting the `AWS_PROFILE` env-var or for a single `aws` command invocation by passing the `--profile <NAME>`. Credentials stored in `~/.aws/credentials` per named profile. You can create a [named profile](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) with `aws configure --profile <NAME>`. If you omit `--profile` the `default` profile is configured. If your account supports SSO, running `aws configure sso` will configure the aws cli to use a profile and open a web browser. SSO profile configuration is stored as a profile stanza in `config` and no secrets are stored in `credentials`. `aws sts get-caller-identity` to check authentication. More details in the [Configuring the AWS CLI - AWS Command Line Interface](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) user guide. --- - Links: - Created at: [[2021-04-02]]