Where Does the AWS CLI Store Credentials?
AWS CLI credentials and config file paths on Windows, macOS and Linux, and how profiles, SSO cache and env vars override them.
Last updated
The AWS CLI keeps keys in two INI files inside a .aws folder in your home directory. The credentials file holds access keys per profile. The config file holds regions, outputs and SSO settings. Profiles in brackets select which block applies.
Environment variables beat both files, and SSO logins add a cache folder beside them. Never commit these files to git. Run aws configure list to see which source a command actually used when behavior looks wrong. The sts get-caller-identity call confirms which account is active.
Where AWS CLI stores this, by platform
C:\Users\[Username]\.aws\credentials
The config file sits beside it at C:\Users\[Username]\.aws\config. SSO cache lives in .aws\sso\cache. Set AWS_SHARED_CREDENTIALS_FILE to relocate the credentials file.
~/.aws/credentials
Same layout as Linux. Keep both files at 600 permissions. The AWS Toolkit for VS Code and JetBrains reads this exact folder, so one setup serves every tool.
~/.aws/credentials
Respects $AWS_SHARED_CREDENTIALS_FILE and $AWS_CONFIG_FILE when set. Container images often mount these from secrets instead of baking them into layers.
Frequently asked questions
How do I use multiple AWS accounts?
Add a [profile name] section to both files with aws configure --profile name. Then pass --profile name on commands or set AWS_PROFILE. The [default] section applies when no profile is given.
Why does the CLI ignore my credentials file?
Environment variables take precedence. Check AWS_ACCESS_KEY_ID and AWS_PROFILE first, then aws configure list to see the active source. Stale SSO tokens need aws sso login again.
Notice an outdated path? Let us know.