I typed the wrong AWS CLI command. The screen filled with red text. Access denied.
Authorization in the AWS Command Line Interface is where speed meets danger. A single flag or environment variable can open or lock every door in your cloud. If you work in AWS daily, mastering AWS CLI authorization isn’t a choice. It’s self-defense.
AWS CLI uses access keys, secret keys, and session tokens. These credentials decide what you can or cannot touch. The safest way to handle them is never to hard-code them. Store them in the AWS credentials file under ~/.aws/credentials. Use profiles to separate access for different accounts or roles.
Run aws configure --profile myprofile to set your keys and region without exposing them in your shell history. Switch between profiles with --profile myprofile. This keeps mistakes from bleeding into production environments.
For temporary access, lean on AWS STS (Security Token Service). Issue session tokens with aws sts assume-role --role-arn arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME --role-session-name SESSION_NAME. Store the output in environment variables and set them with export AWS_ACCESS_KEY_ID=..., export AWS_SECRET_ACCESS_KEY=..., and export AWS_SESSION_TOKEN=....
MFA (Multi-Factor Authentication) changes the game. Require it for sensitive roles, then call aws sts get-session-token --serial-number arn-of-the-mfa-device --token-code code-from-token. This makes leaked credentials useless without the MFA device.
Keep your ~/.aws/config clean. Use region and output settings to avoid setting them on every command. Limit privileges in IAM policies attached to your keys. If a script only needs read access to S3, don’t give it write.
Rotate credentials. Remove old keys from IAM. Audit aws configure list to see where your shell is pulling its auth from. Environment variables override profiles, so check them first when debugging.
Logging is your ally. Enable AWS CloudTrail. Every CLI action runs as an API call. CloudTrail can trace it back to the source user, the credentials, and the time. Monitor these logs and catch abuse early.
The less you store locally, the better. For build systems or automation, consider AWS IAM Roles Anywhere or assigning IAM instance roles directly to instances, Lambda functions, or containers. This removes human-managed keys entirely.
Good AWS CLI authorization hygiene is about speed without recklessness. It’s the discipline that keeps least privilege truly least.
You can put these concepts into practice instantly. Check out hoop.dev and see how you can secure AWS CLI workflows live in minutes—without reworking your stack.