What aws configure Actually Does
Before you can run any AWS command, the CLI needs to know who you are and where you want to operate. Running aws configure is the handshake that establishes this. It writes two files to your home directory:
~/.aws/credentials— stores your Access Key ID and Secret Access Key (sensitive, never commit this to git)~/.aws/config— stores non-secret settings like default region and output format
aws configure
# AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
# AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# Default region name [None]: us-east-1
# Default output format [None]: json
This creates a [default] profile. The output format can be json, yaml, text, or table — json is the most useful for scripting because it can be piped into tools like jq.
What Gets Written
After running aws configure, inspect the files directly:
cat ~/.aws/credentials
# [default]
# aws_access_key_id = AKIAIOSFODNN7EXAMPLE
# aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
cat ~/.aws/config
# [default]
# region = us-east-1
# output = json
Key Point: Access keys are long-term credentials tied to an IAM user. They do not expire unless you rotate or delete them. This is both their convenience and their risk. In production environments, prefer IAM Roles (which issue short-lived temporary credentials) over long-term access keys wherever possible.