A config section without the prefix
Reported as a profile that does not exist
[dev] region = eu-west-1 output = json
AWS CLI Profile Analyzer
Read a CLI profile file for the reasons a profile is not found or points at the wrong account. Secret values are never shown or exported.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Analyze. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
A role with nothing to assume it from
No credential to sign the AssumeRole call with
[profile dev] region = eu-west-1 role_arn = arn:aws:iam::111122223333:role/Deployer
A permanent key on disk
Never expires, in a plain text file every backup tool copies
[default] aws_access_key_id = AKIAIOSFODNN7EXAMPLE aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Copying a section between the config and credentials files
The prefix rule is opposite between them, so the section is either invisible or looked up under a name including the word profile.
Instead:Use [profile name] in config and [name] in credentials.
Debugging a profile that is being ignored
AWS_PROFILE and AWS_ACCESS_KEY_ID in the environment override the files entirely and nothing reports it.
Instead:Run env | grep AWS_ and aws sts get-caller-identity before changing anything in the files.
Setting role_arn without source_profile
Assuming a role needs a starting credential to sign the call with, and there is nothing to use.
Instead:Add source_profile, or credential_source on an instance.
The profile prefix is required in one file and forbidden in the other
Every section in ~/.aws/config except [default] needs [profile name]. Every section in ~/.aws/credentials needs the bare [name]. Get it the wrong way round and the CLI reports the profile as not found.
Which is the least helpful error it could give
It suggests the profile does not exist rather than that its header is written for the other file, and the two files sit next to each other with the same syntax.
An environment variable beats both files silently
The CLI checks command line options, then the environment, then these files. A stale AWS_ACCESS_KEY_ID exported in a shell profile years ago overrides every profile here and points every command at the wrong account, with no warning.
aws sts get-caller-identity is the answer to that
It says which principal is actually in use, which is the only reliable way to find out. env | grep AWS_ says why.
role_arn needs somewhere to assume from
Either source_profile, naming another profile, or credential_source, naming the environment or an instance role. Setting both is an error rather than a preference, because they answer the same question.
A region in the profile beats the environment for that profile
Without one, the CLI falls back to AWS_REGION, then AWS_DEFAULT_REGION, then errors. A command that works in one shell and not another is usually this and nothing else.
A permanent key in ~/.aws/credentials is a plain text file
Backup tools, editors, container mounts and screen shares all copy it, and an AKIA key never expires. aws sso login or a role profile writes nothing permanent to disk.
More aws tools
AWS IAM Policy Validator & Analyzer Valid JSON? And what does it grant? AWS IAM Policy Evaluator Is this actually allowed? AWS S3 Bucket Policy Analyzer Is this bucket actually public? AWS S3 Bucket Policy Generator Pick a pattern, get a safe policy AWS ARN Decoder Split it up, and check it is right AWS ECS Task Definition Analyzer Two roles, and they are not the same AWS S3 Lifecycle Policy Analyzer Minimum durations you still pay AWS S3 Presigned URL Decoder It dies with the session AWS Lambda Configuration Analyzer Memory is the CPU dial AWS SQS Visibility Timeout Calculator Six times the function timeout AWS EventBridge Pattern Tester Every leaf value is an array AWS DynamoDB Capacity Calculator Every index costs a write AWS Resource Name Validator A dot in a bucket breaks TLS AWS IAM Trust Policy Analyzer Account root means the whole account AWS Access Key ID Identifier AKIA never expires, ASIA does AWS STS Assume Role Command Builder Chaining caps at one hour AWS KMS Key Policy Analyzer The one AWS mistake with no undo AWS Security Group Analyzer They cannot deny anything AWS Network ACL Return Traffic Checker Stateless, so replies need a rule