The Multi-Account Reality
You rarely work in just one AWS account. A typical engineering setup has at minimum a Dev account, a Staging account, and a Prod account — often with separate accounts for security tooling, billing, and shared services. Managing credentials for all of them by constantly overwriting your [default] keys is error-prone and dangerous.
Named Profiles solve this. Each profile is an isolated set of credentials and configuration stored under a named section in your AWS config files.
Creating Named Profiles
aws configure --profile dev
# AWS Access Key ID [None]: AKIA...DEV
# AWS Secret Access Key [None]: ...
# Default region name [None]: us-west-2
# Default output format [None]: json
aws configure --profile prod
# AWS Access Key ID [None]: AKIA...PROD
# AWS Secret Access Key [None]: ...
# Default region name [None]: us-east-1
# Default output format [None]: json
Your ~/.aws/credentials file now looks like:
[default]
aws_access_key_id = AKIA...DEFAULT
aws_secret_access_key = ...
[dev]
aws_access_key_id = AKIA...DEV
aws_secret_access_key = ...
[prod]
aws_access_key_id = AKIA...PROD
aws_secret_access_key = ...
Using Named Profiles
CLI — per command:
aws s3 ls --profile dev
aws ec2 describe-instances --profile prod --region us-east-1
CLI — for an entire terminal session:
export AWS_PROFILE=dev
aws s3 ls # automatically uses dev profile
aws sts get-caller-identity # confirm which account you're in
SDK (Python/Boto3):
import boto3
# Explicit profile
session = boto3.Session(profile_name='dev')
s3 = session.client('s3')
# Or rely on AWS_PROFILE environment variable
s3 = boto3.client('s3') # picks up AWS_PROFILE=dev from environment
Verifying Your Active Identity
Before running any destructive command, always confirm which account and identity you're operating as:
aws sts get-caller-identity
Output:
{
"UserId": "AIDAIOSFODNN7EXAMPLE",
"Account": "123456789012",
"Arn": "arn:aws:iam::123456789012:user/alice"
}
This single command has prevented countless accidental Prod deployments. Make it a habit.