Topics

• Format of the configuration and credential files

• Where are configuration settings stored?

• Using named profiles

• Set and view configuration settings using commands

• Setting new configuration and credentials command examples

• Supported config file settings

• Section names are enclosed in brackets [ ] such as[default],[profileuser1], and[sso-session].

• All entries in a section take the general form ofsetting_name=value.

• Lines can be commented out by starting the line with a hash character (#).

The config and credentials files contain the following section types:

• profile

• sso-session

• services

• Config file:[default][profileuser1]

• Credentials file:[default][user1]

  Donot use the wordprofile when creating an entry in thecredentials file.

• (Required)sso_start_url

• (Required)sso_region

• sso_account_id

• sso_role_name

• sso_registration_scopes

aws configure

Run this command to quickly set and view your credentials, Region, and output format. The following example shows sample values.

$aws configureAWS Access Key ID [None]:AKIAIOSFODNN7EXAMPLEAWS Secret Access Key [None]:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEYDefault region name [None]:us-west-2Default output format [None]:json

aws configure set

You can set any credentials or configuration settings usingaws configure set. Specify the profile that you want to view or modify with the--profile setting.

For example, the following command sets theregion in the profile namedinteg.

$aws configure set regionus-west-2 --profileinteg

To remove a setting, manually delete the setting in yourconfig andcredentials files in a text editor.

aws configure get

You can retrieve any credentials or configuration settings you've set usingaws configure get. Specify the profile that you want to view or modify with the--profile setting.

For example, the following command retrieves theregion setting in the profile namedinteg.

$aws configure getregion --profileintegus-west-2

If the output is empty, the setting is not explicitly set and uses the default value.

aws configure import

ImportCSV credentials generated from the IAM web console. This is not for credentials generated from IAM Identity Center; customers who use IAM Identity Center should use aws configure sso. A CSV file is imported with the profile name matching the username. The CSV file must contain the following headers.

• User Name

• Access key ID

• Secret access key

Note

During initial key pair creation, once you close theDownload .csv file dialog box, you cannot access your secret access key after you close the dialog box. If you need a.csv file, you'll need to create one yourself with the required headers and your stored key pair information. If you do not have access to your key pair information, you need to create a new key pair.

$aws configure import --csvfile://credentials.csv

aws configure list

To list configuration data, use theaws configure list command. This command lists the profile, access key, secret key, and region configuration information used for the specified profile. For each configuration item, it shows the value, where the configuration value was retrieved, and the configuration variable name.

For example, if you provide the AWS Region in an environment variable, this command shows you the name of the region you've configured, that this value came from an environment variable, and the name of the environment variable.

For temporary credential methods such as roles and IAM Identity Center, this command displays the temporarily cached access key and secret access key is displayed.

$aws configure listNAME       : VALUE                : TYPE                    : LOCATIONprofile    : <not set>            : None                    : Noneaccess_key : ****************ABCD : shared-credentials-file : secret_key : ****************ABCD : shared-credentials-file : region     : us-west-2            : env                     : AWS_DEFAULT_REGION

aws configure list-profiles

To list all your profile names, use theaws configure list-profiles command.

$aws configure list-profilesdefaulttest

aws configure mfa-login

Run this command to configure a new profile to use with multi-factor authentication (MFA) and your IAM user credentials in the specified profile. If no profile is specified, the MFA is based on thedefault profile. If no default profile is configured, themfa-login command prompts you for you AWS credentials before asking for your MFA information. The following command example uses your default configuration and creates an MFA profile.

$aws configure mfa-loginMFA serial number or ARN:arn:aws:iam::123456789012:mfa/MFADeviceNameMFA token code:123456Profile to update [session-MFADeviceName]:Temporary credentials written to profile 'session-MFADeviceName'Credentials will expire at 2023-05-19 18:06:10 UTCTo use these credentials, specify --profile session-MFADeviceName when running AWS CLI commands

To update an existing profile, use the--update-profile parameter.

$aws configure mfa-login --profilemyprofile --update-profilemfaprofileMFA token code:123456Temporary credentials written to profile 'mfaprofile'Credentials will expire at 2023-05-19 18:06:10 UTCTo use these credentials, specify --profile mfaprofile when running AWS CLI commands

This command currently supports only hardware or software based one-time password (OTP) authenticators. Passkeys and U2F devices are not currently supported with this command.

For more information on using MFA with IAM, seeAWS Multi-factor authentication in IAM in theAWS Identity and Access Management User Guide.

aws configure sso

Run this command to quickly set and view your AWS IAM Identity Center credentials, Region, and output format. The following example shows sample values.

$aws configure ssoSSO session name (Recommended):my-ssoSSO start URL [None]:https://my-sso-portal.awsapps.com/startSSO region [None]:us-east-1SSO registration scopes [None]:sso:account:access

aws configure sso-session

Run this command to quickly set and view your AWS IAM Identity Center credentials, Region, and output format in thesso-session section of thecredentials andconfig files. The following example shows sample values.

$aws configure sso-sessionSSO session name:my-ssoSSO start URL [None]:https://my-sso-portal.awsapps.com/startSSO region [None]:us-east-1SSO registration scopes [None]:sso:account:access

aws configure export-credentials

Run this command to export currently set credentials in the specified format. By default, the command exports the default credentials in theprocess format, which is a JSON format supported by the AWS SDKs and Tools credential format.

$aws configure export-credentials{  "Version": 1,  "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"}

To export a specific profile and format, use the--profile and--format options. The format options are as follows:

• (default)process ‐ The JSON format supported by the AWS SDKs and Toolscredential_process configuration.

• env ‐ Environment variables in exported shell format.

• env-no-export ‐ Non-exported environment variables in shell format.

• powershell ‐ Environment variables in PowerShell format.

• windows-cmd ‐ Environment variables in Windows Command Line format.

The following example exports theuser1 profile to an exported shell format.

$aws configure export-credentials--profile user1 --format envexport AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLEexport AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Topics

• Global settings

• S3 Custom command settings

account_id_endpoint_mode

Specifies whether to use AWS account-based endpoint IDs for calls to supported AWS services. For more information on account-based endpoints, seeAccount-based endpoints.

This setting can be set to the following:

• (default)preferred – The endpoint should include account ID if available.

• disabled – A resolved endpoint doesn't include account ID.

• required – The endpoint must include account ID. If the account ID isn't available, the SDK throws an error.

Can be overridden by theAWS_ACCOUNT_ID_ENDPOINT_MODE environment variable. To use account-based endpoints, the ID must be set in theAWS_ACCOUNT_ID environment variable oraws_account_id setting.

account_id_endpoint_mode =preferred

Endpoint precedence

Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, seeEndpoint configuration and settings precedence.

aws_access_key_id

Specifies the AWS access key used as part of the credentials to authenticate the command request. Although this can be stored in theconfig file, we recommend that you store this in thecredentials file.

Can be overridden by theAWS_ACCESS_KEY_ID environment variable. You can't specify the access key ID as a command line option.

aws_access_key_id =AKIAIOSFODNN7EXAMPLE

aws_account_id

Specifies the AWS account-based endpoint ID to use for calls to supported AWS services. For more information on account-based endpoints, seeAccount-based endpoints.

Can be overridden by theAWS_ACCOUNT_ID environment variable. TheAWS_ACCOUNT_ID_ENDPOINT_MODE environment variable oraccount_id_endpoint_mode setting must be set topreferred orrequired to use this setting.

aws_account_id =123456789EXAMPLE

Endpoint precedence

Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, seeEndpoint configuration and settings precedence.

aws_secret_access_key

Specifies the AWS secret key used as part of the credentials to authenticate the command request. Although this can be stored in theconfig file, we recommend that you store this in thecredentials file.

Can be overridden by theAWS_SECRET_ACCESS_KEY environment variable. You can't specify the secret access key as a command line option.

aws_secret_access_key =wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

aws_session_token

Specifies an AWS session token. A session token is required only if you manually specify temporary security credentials. Although this can be stored in theconfig file, we recommend that you store this in thecredentials file.

Can be overridden by theAWS_SESSION_TOKEN environment variable. You can't specify the session token as a command line option.

aws_session_token =AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4Olgk

ca_bundle

Specifies a CA certificate bundle (a file with the.pem extension) that is used to verify SSL certificates.

Can be overridden by theAWS_CA_BUNDLE environment variable or the--ca-bundle command line option.

ca_bundle =dev/apps/ca-certs/cabundle-2019mar05.pem

cli_auto_prompt

Enables the auto-prompt for the AWS CLI version 2. There are two settings that can be used:

• on uses the full auto-prompt mode each time you attempt to run anaws command. This includes pressingENTER after both a complete command or incomplete command.

  cli_auto_prompt = on

• on-partial uses partial auto-prompt mode. If a command is incomplete or cannot be run due to client-side validation errors, auto-prompt is used. This mode is particular useful if you have pre-existing scripts, runbooks, or you only want to be auto-prompted for commands you are unfamiliar with rather than prompted on every command.

  cli_auto_prompt = on-partial

You can override this setting by using theaws_cli_auto_prompt environment variable or the--cli-auto-prompt and--no-cli-auto-prompt command line parameters.

For information on the AWS CLI version 2 auto-prompt feature, seeEnabling and using command prompts in the AWS CLI.

cli_binary_format

Specifies how the AWS CLI version 2 interprets binary input parameters. It can be one of the following values:

• base64 – This is the default value. An input parameter that is typed as a binary large object (BLOB) accepts a base64-encoded string. To pass true binary content, put the content in a file and provide the file's path and name with thefileb:// prefix as the parameter's value. To pass base64-encoded text contained in a file, provide the file's path and name with thefile:// prefix as the parameter's value.

• raw-in-base64-out – Default for the AWS CLI version 1. If the setting's value israw-in-base64-out, files referenced using thefile:// prefix is read as text and then the AWS CLI attempts to encode it to binary.

This entry does not have an equivalent environment variable. You can specify the value on a single command by using the--cli-binary-format raw-in-base64-out parameter.

cli_binary_format = raw-in-base64-out

If you reference a binary value in a file using thefileb:// prefix notation, the AWS CLIalways expects the file to contain raw binary content and does not attempt to convert the value.

If you reference a binary value in a file using thefile:// prefix notation, the AWS CLI handles the file according to the currentcli_binary_format setting. If that setting's value isbase64 (the default when not explicitly set), the AWS CLI expects the file to contain base64-encoded text. If that setting's value israw-in-base64-out, the AWS CLI expects the file to contain raw binary content.

cli_help_output

As of version2.31.0 The display for thehelp command is configured by thecli_help_output setting, and has the following values:

• (default)terminal ‐ Open the man page in the terminal.

• browser ‐ Open the man page as a local HTML file in your default browser. A notice is printed to your terminal when your default browser is being opened, and an error message if the AWS CLI cannot open your browser.

• url ‐ Print the URL to the online AWS CLI Reference Guide for the version of the AWS CLI you have installed. Settings for client-side paging, such as theAWS_PAGER environment variable, is respected.

cli_help_output = browser

For more information on thehelp command, seeAccessing help and resources for the AWS CLI.

cli_history

Disabled by default. This setting enables command history for the AWS CLI. After enabling this setting, the AWS CLI records the history ofaws commands.

cli_history = enabled

You can list your history using theaws history list command, and use the resultingcommand_ids in theaws history show command for details. For more information seeaws history in theAWS CLI reference guide.

cli_pager

Specifies the pager program used for output. By default, AWS CLI version 2 returns all output through your operating system’s default pager program.

Can be overridden by the AWS_PAGER environment variable.

cli_pager=less

cli_timestamp_format

Specifies the output format of timestamp values. You can specify either of the following values:

• iso8601 – The default value for the AWS CLI version 2. If specified, the AWS CLI reformats all timestamps in the output according toISO 8601. ISO 8601 formatted timestamps look like the following examples. The following example demonstrates how the time is formatted by separating the date and time with aT and including aZ after the time.

  YYYY-MM-DDThh:mm:ssZ

  The following examples shows a timestamp using the previous formatting.

  2024-05-08T15:16:43Z

• wire – The default value for the AWS CLI version 1. If specified, the AWS CLI displays all timestamp values exactly as received in the HTTP query response.

This setting does not have an equivalent environment variable or command line option. This setting does not alter timestamp inputs, only output formatting.

cli_timestamp_format = iso8601

credential_process

Specifies an external command that the AWS CLI runs to generate or retrieve authentication credentials to use for this command. The command must return the credentials in a specific format. For more information about how to use this setting, seeSourcing credentials with an external process in the AWS CLI.

This entry does not have an equivalent environment variable or command line option.

credential_process =/opt/bin/awscreds-retriever --username susan

credential_source

Used within Amazon EC2 instances or containers to specify where the AWS CLI can find credentials to use to assume the role you specified with therole_arn parameter. You cannot specify bothsource_profile andcredential_source in the same profile.

This parameter can have one of three values:

• Environment – Specifies that the AWS CLI is to retrieve source credentials from environment variables.

• Ec2InstanceMetadata – Specifies that the AWS CLI is to use the IAM role attached to theEC2 instance profile to get source credentials.

• EcsContainer – Specifies that the AWS CLI is to use the IAM role attached to the ECS container as source credentials.

credential_source = Ec2InstanceMetadata

duration_seconds

Specifies the maximum duration of the role session, in seconds. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role (which can be a maximum of 43200). This is an optional parameter and by default, the value is set to 3600 seconds.

endpoint_url

Specifies the endpoint that is used for all service requests. If this setting is used in theservices section of theconfig file, then the endpoint is used only for the specified service. For more information, seeSet global endpoint for all AWS services.

The following example uses the global endpointhttp://localhost:1234 and a service-specific endpoint ofhttp://localhost:4567 for Amazon S3.

[profile dev]endpoint_url = http://localhost:1234services = s3-specific[services s3-specific]s3 =   endpoint_url = http://localhost:4567

Endpoint precedence

Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, seeEndpoint configuration and settings precedence.

ignore_configure_endpoint_urls

If enabled, the AWS CLI ignores all custom endpoint configurations specified in theconfig file. Valid values aretrue andfalse.

ignore_configure_endpoint_urls = true

Endpoint precedence

Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, seeEndpoint configuration and settings precedence.

external_id

Specifies a unique identifier that is used by third parties to assume a role in their customers' accounts. This maps to theExternalId parameter in theAssumeRole operation. This parameter is needed only if the trust policy for the role specifies a value forExternalId. For more information, seeHow to use an external ID when granting access to your AWS resources to a third party in theIAM User Guide.

max_attempts

Specifies a value of maximum retry attempts the AWS CLI retry handler uses, where the initial call counts toward themax_attempts value that you provide.

You can override this value by using theAWS_MAX_ATTEMPTS environment variable.

max_attempts =3

mfa_serial

The identification number of an MFA device to use when assuming a role. This is mandatory only if the trust policy of the role being assumed includes a condition that requires MFA authentication. The value can be either a serial number for a hardware device (such asGAHT12345678) or an Amazon Resource Name (ARN) for a virtual MFA device (such asarn:aws:iam::123456789012:mfa/user).

output

Specifies the default output format for commands requested using this profile. You can specify any of the following values:

• json – The output is formatted as aJSON string.

• yaml – The output is formatted as aYAML string.

• yaml-stream – The output is streamed and formatted as aYAML string. Streaming allows for faster handling of large data types.

• text – The output is formatted as multiple lines of tab-separated string values. This can be useful to pass the output to a text processor, likegrep,sed, orawk.

• table – The output is formatted as a table using the characters +|- to form the cell borders. It typically presents the information in a "human-friendly" format that is much easier to read than the others, but not as programmatically useful.

Can be overridden by theAWS_DEFAULT_OUTPUT environment variable or the--output command line option.

output =table

parameter_validation

Specifies whether the AWS CLI client attempts to validate parameters before sending them to the AWS service endpoint.

• true – This is the default value. If specified, the AWS CLI performs local validation of command line parameters.

• false – If specified, the AWS CLI does not validate command line parameters before sending them to the AWS service endpoint.

This entry does not have an equivalent environment variable or command line option.

parameter_validation = false

region

Specifies the AWS Region to send requests to for commands requested using this profile.

• You can specify any of the Region codes available for the chosen service as listed inAWS Regions and Endpoints in theAmazon Web Services General Reference.

• aws_global enables you to specify the global endpoint for services that support a global endpoint in addition to Regional endpoints, such as AWS Security Token Service (AWS STS) and Amazon Simple Storage Service (Amazon S3).

You can override this value by using theAWS_REGION environment variable,AWS_DEFAULT_REGION environment variable, or the--region command line option.

region =us-west-2

request_checksum_calculation

Specifies when a checksum is calculated for request payloads, and has the following options:

• when_supported –(Default) The request payload checksum is calculated when an operation either specifies a checksum algorithm in its service model or requires request checksums.

• when_required – The request payload checksum is calculated when an operation requires request checksums or when a user provides arequestAlgorithmMember that is modeled by the AWS service.

request_checksum_calculation =when_supported

The environment variableAWS_REQUEST_CHECKSUM_CALCULATION overrides this setting.

response_checksum_validation

Specifies when checksum validation is performed for response payloads, and has the following options:

• when_supported –(Default) The response payload checksum validation is performed when an operation specifies a response algorithm in its service model that the AWS CLI supports.

• when_required – The response payload checksum validation is performed when an operation specifies a response algorithm in its service model that the AWS CLI supports, and you set the modeledrequestValidationModeMember toENABLED in the operation input.

response_checksum_validation =when_supported

The environment variableAWS_RESPONSE_CHECKSUM_VALIDATION overrides this setting.

retry_mode

Specifies which retry mode AWS CLI uses. There are three retry modes available:standard (default),legacy (default), andadaptive. For more information on retries, seeAWS CLI retries in the AWS CLI.

You can override this value by using theAWS_RETRY_MODE environment variable.

retry_mode =standard

role_arn

Specifies the Amazon Resource Name (ARN) of an IAM role that you want to use to run the AWS CLI commands. You must also specify one of the following parameters to identify the credentials that have permission to assume this role:

• source_profile

• credential_source

role_arn = arn:aws:iam::123456789012:role/role-name

The environment variableAWS_ROLE_ARN overrides this setting.

For more information on using web identities, seeAssume role with web identity.

role_session_name

Specifies the name to attach to the role session. This value is provided to theRoleSessionName parameter when the AWS CLI calls theAssumeRole operation, and becomes part of the assumed role user ARN: arn:aws:sts::123456789012:assumed-role/role_name/role_session_name. This is an optional parameter. If you do not provide this value, a session name is generated automatically. This name appears in AWS CloudTrail logs for entries associated with this session.

role_session_name =maria_garcia_role

The environment variableAWS_ROLE_SESSION_NAME overrides this setting.

For more information on using web identities, seeAssume role with web identity.

services

Specifies the service configuration to use for your profile.

[profiledev-s3-specific-and-global]endpoint_url =http://localhost:1234services =s3-specific[servicess3-specific]s3 =   endpoint_url =http://localhost:4567

For more information on theservices section, seeSection type: services.

The environment variableAWS_ROLE_SESSION_NAME overrides this setting.

For more information on using web identities, seeAssume role with web identity.

sdk_ua_app_id

A single AWS account can be used by multiple customer applications to make calls to AWS services. Application ID identifies which source application made a set of calls using an AWS service. AWS SDKs and services don't use or interpret this value other than to surface it back in customer communications. For example, this value can be included in operational emails to uniquely identify which of your applications is associated with the notification.

The Application ID is a string with maximum length of 50 characters. Letters, numbers and the following special characters are allowed:! $ % & * + - . , ^ _ ` | ~ By default, no value is assigned.

sdk_ua_app_id =prod1

This setting can be overwritten by using theAWS_SDK_UA_APP_ID environment variable. You can't set this value as a command line parameter.

sigv4a_signing_region_set

Specifies the regions to use when signing with SigV4a using a comma-delimited list. If this variable is not set, the AWS CLI uses the default used by the AWS service. If the AWS service has no default, the request signature becomes valid in all regions using a value of*.

sigv4a_signing_region_set =us-west-2, us-east-1

For more information on SigV4a, seeAWS Signature Version 4 for API requests in theIAM User Guide

This setting can be overwritten by using theAWS_SIGV4A_SIGNING_REGION_SET environment variable. You can't set this value as a command line parameter.

source_profile

Specifies a named profile with long-term credentials that the AWS CLI can use to assume a role that you specified with therole_arn parameter. You cannot specify bothsource_profile andcredential_source in the same profile.

source_profile =production-profile

sso_account_id

Specifies the AWS account ID that contains the IAM role with the permission that you want to grant to the associated IAM Identity Center user.

This setting does not have an environment variable or command line option.

sso_account_id = 123456789012

sso_region

Specifies the AWS Region that contains the AWS access portal host. This is separate from, and can be a different Region than the default CLIregion parameter.

This setting does not have an environment variable or command line option.

sso_region = us_west-2

sso_registration_scopes

A comma-delimited list of scopes to be authorized for thesso-session. Scopes authorize access to IAM Identity Center bearer token authorized endpoints. A valid scope is a string, such assso:account:access. This setting isn't applicable to the legacy non-refreshable configuration.

sso_registration_scopes = sso:account:access

sso_role_name

Specifies the friendly name of the IAM role that defines the user's permissions when using this profile.

This setting does not have an environment variable or command line option.

sso_role_name = ReadAccess

sso_start_url

Specifies the URL that points to the organization's AWS access portal. The AWS CLI uses this URL to establish a session with the IAM Identity Center service to authenticate its users. To find your AWS access portal URL, use one of the following:

• Open your invitation email, the AWS access portal URL is listed.

• Open the AWS IAM Identity Center console athttps://console.aws.amazon.com/singlesignon/. The AWS access portal URL is listed in your settings.

This setting does not have an environment variable or command line option.

sso_start_url =https://my-sso-portal.awsapps.com/start

use_dualstack_endpoint

Enables the use of dual-stack endpoints to send AWS requests. To learn more about dual-stack endpoints, which support both IPv4 and IPv6 traffic, seeUsing Amazon S3 dual-stack endpoints in theAmazon Simple Storage Service User Guide. Dual-stack endpoints are available for some services in some regions. If a dual-stack endpoint does not exist for the service or AWS Region, the request fails. Valid settings aretrue andfalse. This is disabled by default. For more information, seeSet to use dual-stack endpoints for all AWS services.

This is mutually exclusive with theuse_accelerate_endpoint setting.

Endpoint precedence

Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, seeEndpoint configuration and settings precedence.

use_fips_endpoint

Some AWS services offer endpoints that supportFederal Information Processing Standard (FIPS) 140-2 in some AWS Regions. When the AWS service supports FIPS, this setting specifies what FIPS endpoint the AWS CLI should use . Unlike standard AWS endpoints, FIPS endpoints use a TLS software library that complies with FIPS 140-2. These endpoints might be required by enterprises that interact with the United States government. For more information see,Set to use FIPs endpoints for all AWS services.

If this setting is enabled, but a FIPS endpoint does not exist for the service in your AWS Region, the AWS command may fail. In this case, manually specify the endpoint to use in the command using the--endpoint-url option or useservice-specific endpoints.

Endpoint precedence

Endpoint configuration settings are located in multiple places, such as the system or user environment variables, local AWS configuration files, or explicitly declared on the command line as a parameter. The AWS CLI checks these endpoint settings in a particular order, and uses the endpoint setting with the highest precedence. For the endpoint precedence list, seeEndpoint configuration and settings precedence.

web_identity_token_file

Specifies the path to a file that contains an OAuth 2.0 access token or OpenID Connect ID token that is provided by an identity provider. The AWS CLI loads the contents of this file and passes it as theWebIdentityToken argument to theAssumeRoleWithWebIdentity operation.

The environment variableAWS_WEB_IDENTITY_TOKEN_FILE overrides this setting.

For more information on using web identities, seeAssume role with web identity.

tcp_keepalive

Specifies whether the AWS CLI client uses TCP keep-alive packets.

This entry does not have an equivalent environment variable or command line option.

tcp_keepalive = false

addressing_style

Specifies which addressing style to use. This controls whether the bucket name is in the hostname or is part of the URL. Valid values are:path,virtual, andauto. The default value isauto.

There are two styles of constructing an Amazon S3 endpoint. The first is calledvirtual and includes the bucket name as part of the hostname. For example:https://bucketname.s3.amazonaws.com. Alternatively, with thepath style, you treat the bucket name as if it is a path in the URI; for example,https://s3.amazonaws.com/bucketname. The default value in the CLI is to useauto, which attempts to use thevirtual style where it can, but will fall back topath style when required. For example, if your bucket name is not DNS compatible, the bucket name cannot be part of the hostname and must be in the path. Withauto, the CLI will detect this condition and automatically switch topath style for you. If you set the addressing style topath, you must then ensure that the AWS Region you configured in the AWS CLI matches the Region of your bucket.

payload_signing_enabled

Specifies whether to SHA256 sign sigv4 payloads. By default, this is disabled for streaming uploads (UploadPart andPutObject) when using HTTPS. By default, this is set tofalse for streaming uploads (UploadPart andPutObject), but only if aContentMD5 is present (it is generated by default) and the endpoint uses HTTPS.

If set to true, S3 requests receive additional content validation in the form of a SHA256 checksum which is calculated for you and included in the request signature. If set to false, the checksum isn't calculated. Disabling this can be useful to reduce the performance overhead created by the checksum calculation.

use_accelerate_endpoint

Use the Amazon S3 Accelerate endpoint for alls3 ands3api commands. The default value is false. This is mutually exclusive with theuse_dualstack_endpoint setting.

If set to true, the AWS CLI directs all Amazon S3 requests to theS3 Accelerate endpoint ats3-accelerate.amazonaws.com. To use this endpoint, you must enable your bucket to useS3 Accelerate. All requests are sent using the virtual style of bucket addressing:my-bucket.s3-accelerate.amazonaws.com. AnyListBuckets,CreateBucket, andDeleteBucketrequests aren't sent to the S3 Accelerate endpoint as that endpoint doesn't support those operations. This behavior can also be set if the--endpoint-url parameter is set tohttps://s3-accelerate.amazonaws.com orhttp://s3-accelerate.amazonaws.com for anys3 ors3api command.

use_dualstack_endpoint

Enables the use of dual-stack endpoints to sends3 ands3api requests. To learn more about dual-stack endpoints, which support both IPv4 and IPv6 traffic, seeUsing Amazon S3 dual-stack endpoints in theAmazon Simple Storage Service User Guide. Dual-stack endpoints are available for some services in some regions. If a dual-stack endpoint does not exist for the service or AWS Region, the request fails. Valid settings aretrue andfalse. This is disabled by default. For more information, seeSet to use dual-stack endpoints for all AWS services.

This is mutually exclusive with theuse_accelerate_endpoint setting.

max_bandwidth

Specifies the maximum bandwidth that can be consumed for uploading and downloading data to and from Amazon S3. The default is no limit.

This limits the maximum bandwidth that the S3 commands can use to transfer data to and from Amazon S3. This value applies to only uploads and downloads; it doesn't apply to copies or deletes. The value is expressed as bytes per second. The value can be specified as:

• An integer. For example,1048576 sets the maximum bandwidth usage to 1 megabyte per second.

• An integer followed by a rate suffix. You can specify rate suffixes using:KB/s,MB/s, orGB/s. For example,300KB/s,10MB/s.

In general, we recommend that you first try to lower bandwidth consumption by loweringmax_concurrent_requests. If that doesn't adequately limit bandwidth consumption to the desired rate, you can use themax_bandwidth setting to further limit bandwidth consumption. This is becausemax_concurrent_requests controls how many threads are currently running. If you instead first lowermax_bandwidth but leave a highmax_concurrent_requests setting, it can result in threads having to wait unnecessarily. This can lead to excess resource consumption and connection timeouts.

max_concurrent_requests

Specifies the maximum number of concurrent requests. The default value is 10.

Theaws s3 transfer commands are multithreaded. At any given time, multiple Amazon S3 requests can be running. For example, when you use the commandaws s3 cp localdir s3://bucket/ --recursive to upload files to an S3 bucket, the AWS CLI can upload the fileslocaldir/file1,localdir/file2, andlocaldir/file3 in parallel. The settingmax_concurrent_requests specifies the maximum number of transfer operations that can run at the same time.

You might need to change this value for a few reasons:

• Decreasing this value – On some environments, the default of 10 concurrent requests can overwhelm a system. This can cause connection timeouts or slow the responsiveness of the system. Lowering this value makes the S3 transfer commands less resource intensive. The tradeoff is that S3 transfers can take longer to complete. Lowering this value might be necessary if you use a tool to limit bandwidth.

• Increasing this value – In some scenarios, you might want the Amazon S3 transfers to complete as quickly as possible, using as much network bandwidth as necessary. In this scenario, the default number of concurrent requests might not be sufficient to use all of the available network bandwidth. Increasing this value can improve the time it takes to complete an Amazon S3 transfer.

max_queue_size

Specifies the maximum number of tasks in the task queue. The default value is 1000.

The AWS CLI internally uses a model where it queues up Amazon S3 tasks that are then executed by consumers whose numbers are limited bymax_concurrent_requests. A task generally maps to a single Amazon S3 operation. For example, a task could be aPutObjectTask, or aGetObjectTask, or anUploadPartTask. The rate at which tasks are added to the queue can be much faster than the rate at which consumers finish the tasks. To avoid unbounded growth, the task queue size is capped to a specific size. This setting changes the value of that maximum number.

You generally don't need to change this setting. This setting also corresponds to the number of tasks that the AWS CLI is aware of that need to be run. This means that by default the AWS CLI can only see 1000 tasks ahead. Increasing this value means that the AWS CLI can more quickly know the total number of tasks needed, assuming that the queuing rate is quicker than the rate of task completion. The tradeoff is that a larger max_queue_size requires more memory.

multipart_chunksize

Specifies the chunk size that the AWS CLI uses for multipart transfers of individual files. The default value is 8 MB, with a minimum of 5 MB.

When a file transfer exceeds themultipart_threshold, the AWS CLI divides the file into chunks of this size. This value can be specified using the same syntax asmultipart_threshold, either as the number of bytes as an integer, or by using a size and a suffix.

multipart_threshold

Specifies the size threshold the AWS CLI uses for multipart transfers of individual files. The default value is 8 MB.

When uploading, downloading, or copying a file, the Amazon S3 commands switch to multipart operations if the file exceeds this size. You can specify this value in one of two ways:

• The file size in bytes. For example,1048576.

• The file size with a size suffix. You can useKB,MB,GB, orTB. For example:10MB,1GB.

  Note

  S3 can impose constraints on valid values that can be used for multipart operations. For more information, see theS3 Multipart Upload documentation in theAmazon Simple Storage Service User Guide.