Something is wrong with Initialize-AWSDefaultConfiguration about aws-powershell-user-guide HOT 3 CLOSED

Hi, Michael, I believe what you’re seeing is by design.

The cmdlet reference documentation for Initialize-AWSDefaultConfiguration, and the Using AWS Credentials page to which you linked, do state that this cmdlet’s changes don’t persist outside your current PowerShell session. In the user guide, it states you run Initialize-AWSDefaultConfiguration “…to specify a default profile for every PowerShell session.” The reference topic says, “Creates or updates the credential profile named 'default' and sets the profile, and optionally a region, as active in the current shell.”

The Using AWS Credentials page states that running Initialize-AWSDefaultConfiguration “overwrites any existing profile with that name.” So the fact that the credential store in C:\Users\<user>\.aws\ is missing after you run the cmdlet makes sense, and appears to be by design. On my system, the C:\Users\<user>\.aws\ directory is still present, because I have not run Initialize-AWSDefaultConfiguration.

It makes sense that Set-AWSCredential worked in combination with Initialize-AWSDefaultConfiguration, because with Set-AWSCredential, you are building a new default profile for the current session. And when you run Initialize-AWSDefaultConfiguration with only the -Region parameter once again (but no credentials), you are, per the docs, “overwriting any existing profile,” meaning the default profile you created with Set-AWSCredential gets overwritten.

I can try to make this somewhat clearer in the Using AWS Credentials topic. I can see that this behavior can be confusing. Per Using AWS Credentials, though, “The preferred approach” for specifying credentials “is to use a profile”.

Thank you for telling us about your experience, and for your help to improve the AWS documentation. -- Gaby

from aws-powershell-user-guide.

Right. It should probably be explained a bit more (or it could even be that "less is more").

A suggestion for the specific sentence is:

Start every PowerShell session by using Initialize-AWSDefaultConfiguration to specify a default profile.

Here I've simply reverted the sentence so that it explicitly says that Initialize-AWSDefaultConfiguration is to be run multiple times, and not just "once to specify credentials for every (future) session".

Another issue entirely is the location of the config. It seems the JSON file is "the new default" (?), but it isn't mentioned anywhere.

from aws-powershell-user-guide.

I've revised the AWS Credentials topic to provide a bit more prescriptive guidance. Today, there isn't much need for the Initialize-AWSDefaultConfiguration cmdlet unless you are running the AWS Tools for PowerShell on an EC2 instance that has been launched without an instance profile. Running Initialize-AWSDefaultConfiguration on your local computer can overwrite the default profile with a custom profile that you were using, so it's not without risk. I believe that's what was happening in the original issue.

Currently, on an EC2 instance launched with an instance profile, AWS Tools for PowerShell will get the credentials and region from the instance profile, so there's really no need to run Initialize-AWSDefaultConfiguration in that case (it will just overwrite the existing default profile with the same information). Although the Initialize-AWSDefaultConfiguration cmdlet has a -Region parameter that allows you to use a region other than the default region for your current session, you can also simply change the region by running Set-DefaultAWSRegion to change the region. Running Set-DefaultAWSRegion won't change the region in the instance's profile.

We do say in the Credentials Search Order section that the AWS SDK store credentials are used first (see #2 and #5) before the plain-text credentials in %userdata%.

from aws-powershell-user-guide.