How to temporarily switch profiles for AWS CLI?
Updated answer (7/10/2021): For AWS CLI v1, do this:
export AWS_DEFAULT_PROFILE=user2
For AWS CLI v2, the following will work:
export AWS_PROFILE=user2
The full question is below for context:
(1.) After successfully configuring a second profile for the AWS CLI, I unsuccessfully tried to set the profile to user2 in my bash session with the following command:
export AWS_PROFILE=user2
... per the advice here: https://docs.aws.amazon.com/cli/latest/userguide/cli-multiple-profiles.html
(2.) The following command works:
aws s3 ls --profile user2
So I know that the AWS CLI and the user2 profile are both working on my computer.
(3.) However, when I subsequently (that is, after entering "export AWS_PROFILE=user2") try something like:
aws s3 ls
... AWS's response assumes that I want to query it as the default user (NOT user2)
(4.) So the only way I can use the user2 profile from the command line is by continuing to append "--profile user2" to every single command, which is tedious.
(5.)
echo $AWS_PROFILE
yields:
>> user2
, as expected.
Any idea what's going on here? I'm sure I'm making some dumb mistake somewhere.
Solution 1:
For AWS CLI v1, the cleanest solution is:
export AWS_DEFAULT_PROFILE=user2
Afterward, commands like:
aws s3 ls
... are handled from the appropriate account.
For AWS CLI v2, the following will work:
export AWS_PROFILE=user2
Solution 2:
You can see how it works doing this
$ export AWS_PROFILE=myprofile
$ aws s3 ls --debug 2>&1 | grep profile
2018-04-08 19:19:17,990 - MainThread - botocore.session - DEBUG - Loading variable profile from environment with value 'myprofile'.
I doubt this works differently for you.
You can also verify that
$ AWS_PROFILE=myprofile aws s3 ls --debug 2>&1 | grep profile
and
$ aws s3 ls --profile myprofile --debug 2>&1 | grep profile
all give the same result.
Solution 3:
The accepted answer assumes you are using a Linux or Mac terminal. I added command for both OS.
Windows
set AWS_PROFILE=profile_name
Linux or Mac
export AWS_PROFILE=profile_name
These will set your aws profile that you will use every time you execute an aws command. But if you just want to switch profile temporarily for one aws command.
aws [command] [sub-command] --profile [profile-name]
Solution 4:
AWS cli has 3 level of ways it will read variables
- environment variables of key_id / key_secret
- profile via cred/config (normally in ~/.aws/cre...)
- manual value provided inline
see: https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#credentials
one way will be overwritten by another. based on OP, it might be that although DEFAULT_PROFILE is set as userX, the AWS_ACCESS_KEY_ID and/or AWS_SECRET_ACCESS_KEY environment variables is set to something else.
You can do an alias to a shell function that load credentials to the current environment thru the use of
"export AWS_ACCESS_KEY_ID=XXXXXXX;"... and more
or to be safer load via a secrets manager
"export AWS_ACCESS_KEY_ID=$(aws configure get aws_access_key_id --profile XXXX)"... and more
Export all access key/secrets etc and then check that the right credentials are loaded in memory thru
aws configure list
finally.. do a reset of the the variable to "default" .. as a good habit to ensure you do what you need as the AWS role; especially when using multiple profiles. hope this helps.