AWS CLI Setup Basics

9 examples to get you started with AWS CLI Setup - 6 basic and 3 intermediate.

Prerequisites

• Install AWS CLI v2 (the current major version). On macOS use the official installer or brew install awscli; on Windows use the MSI; on Linux use the bundled installer.
• An AWS account and an IAM identity you can create an access key for, or IAM Identity Center (SSO) access.
• For the SDK examples: Python 3.10+ with pip install boto3, or Node.js 18+ with npm install @aws-sdk/client-sts.

Basic Examples

1. Confirm the CLI Is Installed

Check that AWS CLI v2 is on your PATH before configuring anything.

aws --version
# aws-cli/2.x.x Python/3.x.x Darwin/... exe/x86_64

• The version string must begin with aws-cli/2 - v1 is end-of-support and behaves differently.
• If the command is not found, the installer did not finish or your shell PATH needs a restart.
• Running the SDKs does not strictly require the CLI, but the CLI is the fastest way to create the shared credential files.

Related: The AWS CLI as the SDK's Shared Credential Backbone - why this file matters to your code.

2. Configure Your First Profile

aws configure collects an access key, secret, region, and output format, then saves them.

aws configure
# AWS Access Key ID [None]: AKIAEXAMPLE
# AWS Secret Access Key [None]: wJalrEXAMPLEKEY
# Default region name [None]: us-east-1
# Default output format [None]: json

• With no --profile flag, this writes to the [default] profile.
• The access key and secret go into ~/.aws/credentials; region and output go into ~/.aws/config.
• You only need to do this once per identity; re-running it updates the same profile.

Related: Named Profiles & Multi-Account Config - configure more than one account.

3. Inspect the Files You Just Wrote

The two shared files are plain text and safe to read (keep them private).

# ~/.aws/credentials
[default]
aws_access_key_id = AKIAEXAMPLE
aws_secret_access_key = wJalrEXAMPLEKEY

# ~/.aws/config
[default]
region = us-east-1
output = json

• The [default] header names the profile; other profiles get their own headers.
• Never commit these files to git - add ~/.aws/ patterns to your global gitignore.
• Both SDKs read these exact paths, so editing the files by hand works too.

4. Verify Your Credentials Work

aws sts get-caller-identity is the fastest proof that your setup authenticates.

aws sts get-caller-identity
# {
#   "UserId": "AIDAEXAMPLE",
#   "Account": "123456789012",
#   "Arn": "arn:aws:iam::123456789012:user/you"
# }

• If this returns your account and ARN, every SDK on the machine can authenticate too.
• An InvalidClientTokenId or AuthFailure error means the key is wrong, disabled, or deleted.
• This call costs nothing and touches no resources, so use it freely as a smoke test.

5. Run the Same Check from Both SDKs

The SDKs read the profile you just configured with no keys in code.

# --- Python (boto3) ---
import boto3
 
sts = boto3.client("sts")               # resolves the default profile
identity = sts.get_caller_identity()
print(identity["Account"], identity["Arn"])

// --- TypeScript (AWS SDK v3) ---
import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts";
 
const sts = new STSClient({});           // resolves the default profile
const identity = await sts.send(new GetCallerIdentityCommand({}));
console.log(identity.Account, identity.Arn);

• Neither snippet contains a key or region literal; both inherit them from the shared files.
• This is the payoff of CLI setup: clean, secret-free application code.
• If the CLI call in example 4 worked, these will too.

Related: Environment Variables vs Config File Precedence - how the SDKs decide which credentials to use.

6. Set a Default Region Explicitly

Region is required for most API calls, so make sure a default exists.

aws configure set region us-west-2
aws configure get region
# us-west-2

• aws configure set/get edit and read single settings without the full prompt flow.
• Region lives in ~/.aws/config, not the credentials file, because it is not a secret.
• The AWS_REGION environment variable overrides this value when present.

Intermediate Examples

7. Create and Use a Named Profile

Add a second identity without disturbing your default.

aws configure --profile staging
# ...prompts for the staging account's key, secret, region...
 
aws sts get-caller-identity --profile staging

• --profile staging writes a [staging] block and reads it back for later commands.
• Name profiles by role or account (for example staging, prod-readonly) so intent is obvious.
• The default profile is untouched, so you can switch back with no flag at all.

Related: Named Profiles & Multi-Account Config - the full multi-account layout.

8. Select a Profile via Environment Variable

AWS_PROFILE makes every command and SDK client in the shell use one profile.

export AWS_PROFILE=staging
aws sts get-caller-identity     # uses staging, no flag needed

Both SDKs honor the same variable:

# --- Python (boto3) ---
import os, boto3
 
os.environ["AWS_PROFILE"] = "staging"   # or set it in the shell before launch
sts = boto3.client("sts")
print(sts.get_caller_identity()["Account"])

// --- TypeScript (AWS SDK v3) ---
import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts";
 
process.env.AWS_PROFILE = "staging";     // or set it in the shell before launch
const sts = new STSClient({});
const id = await sts.send(new GetCallerIdentityCommand({}));
console.log(id.Account);

• Setting AWS_PROFILE in the shell keeps profile choice out of your code entirely.
• Prefer setting it before the process starts; mutating process.env after a client is built can be missed.
• This is the cleanest way to run the same script against different accounts.

9. List Your Configured Profiles

Confirm what identities the machine holds before switching between them.

aws configure list-profiles
# default
# staging
# prod-readonly
 
aws configure list --profile staging
# shows the resolved region, output, and credential source for staging

• list-profiles enumerates every profile across both shared files.
• configure list shows where each value came from, which is invaluable when precedence surprises you.
• Use these before a risky command to be sure you are pointed at the right account.

Related: AWS SSO / IAM Identity Center CLI Login - profiles backed by short-lived SSO credentials.

Stack versions: This page was written for the AWS CLI v2, boto3 1.43.x (Python 3.10+), and the AWS SDK for JavaScript v3 (Node.js 18+).