AWS Command Line Interface (CLI) is a powerful tool for managing AWS services, allowing users to execute commands in a terminal or command prompt. It becomes increasingly important when dealing with multiple AWS accounts or roles within a single account. One common task involves temporarily switching between different AWS CLI profiles. This can be easily managed without altering your AWS configuration files permanently.

What are AWS CLI Profiles?

AWS CLI profiles are defined sets of configuration entries that allow CLI users to generate requests to different AWS accounts with different credentials and configurations. Typically, AWS CLI configurations are stored in two main files located in the ~/.aws directory:

• credentials: Contains access keys and secret keys associated with different profiles.
• config: Specifies additional configuration options, such as the default region and output format.

Here's an example of how these files might look:

credentials file:

1[default]
2aws_access_key_id = YOUR_DEFAULT_ACCESS_KEY
3aws_secret_access_key = YOUR_DEFAULT_SECRET_KEY
4
5[profile1]
6aws_access_key_id = YOUR_PROFILE1_ACCESS_KEY
7aws_secret_access_key = YOUR_PROFILE1_SECRET_KEY
8
9[profile2]
10aws_access_key_id = YOUR_PROFILE2_ACCESS_KEY
11aws_secret_access_key = YOUR_PROFILE2_SECRET_KEY

config file:

1[default]
2region = us-east-1
3output = json
4
5[profile profile1]
6region = eu-west-1
7output = text
8
9[profile profile2]
10region = ap-southeast-1
11output = json

Switching Temporarily Between Profiles

Using the AWS_PROFILE Environment Variable

One of the simplest ways to switch AWS profiles temporarily is to use the AWS_PROFILE environment variable. This method allows you to set a specific profile for a single session or a specific command:

1. Set the Environment Variable for a Session:
   On a Unix-like system:

   export AWS_PROFILE=profile1

On Windows:

   set AWS_PROFILE=profile1

1. Run your AWS CLI command:

   aws s3 ls

This command will be executed using the profile1 credentials and configuration.

1. Change or unset the AWS_PROFILE variable as needed:
   To unset it in a Unix-like environment:

   unset AWS_PROFILE

On Windows:

   set AWS_PROFILE=

Specifying the Profile Directly in the CLI Command

Another way to temporarily switch profiles is to specify the profile directly when executing the command using the --profile flag:

aws s3 ls --profile profile2

This command will list S3 buckets using the credentials and configurations defined under profile2.

Comparison Table of Profile Switching Methods

Best Practices for Profile Management

1. Descriptive Profile Names: Use meaningful names for profiles in the configuration files, especially when managing multiple accounts or environments such as dev, test, and prod.
2. Secure Storage of Credentials: Use AWS config overrides or IAM role switching where possible to enhance security.
3. Use of MFA: Consider enforcing Multi-Factor Authentication (MFA) for enhanced security when switching profiles.
4. Script Automation: For regular task automation, incorporate the --profile flag in scripts to ensure that they execute with the appropriate credentials.

By following these practices and using the methods outlined, users can efficiently and securely manage different AWS accounts with the CLI, enhancing both productivity and security posture.