aws configure: Set Credentials and Region in CI

Store AWS CLI credentials, region, and output format - or skip it in CI in favor of OIDC roles.

aws configure writes an access key, secret key, default region, and output format to ~/.aws/credentials and ~/.aws/config. In CI you usually skip it and let short-lived OIDC role credentials flow in through environment variables instead. It remains the fastest way to set a region or one config value non-interactively.

Common flags

--profile NAME - read/write a named profile instead of default
configure set KEY VALUE - write one value non-interactively (scriptable)
configure get KEY - read one resolved value
configure list - print the resolved config and where each value came from
AWS_PROFILE (env) - select a profile without --profile

Example in CI

Set only the region; let OIDC supply credentials via env vars.

shell

aws configure set region us-east-1
aws configure set output json

Common errors in CI

Unable to locate credentials - no key, profile, or role available; configure OIDC role auth
The config profile (NAME) could not be found - --profile points at an undefined profile
You must specify a region - no default region set and none passed

Key takeaways

aws configure writes credentials, region, and output format to ~/.aws.
Prefer aws configure set for scriptable, non-interactive config in CI.
In GitHub Actions, use OIDC role credentials instead of static keys.