World A1: Renting a Unit

The AWS CLI and profiles

You will learn: how the aws command signs in, and how profiles keep accounts apart.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Kancil has two accounts: a practice one and the real shop. He types a delete command. How does aws know which account he means?

Watch

bash

aws sts get-caller-identity

{

"UserId": "AIDASAMPLEUSERID",

"Account": "123456789012",

"Arn": "arn:aws:iam::123456789012:user/DevAdmin"

}

The first habit: ask “who am I?” Read the Arn line. This is the user DevAdmin, in account 123456789012.

Watch

A is a named set of settings in ~/.aws/config. Tap the line that picks the account.

Tap the account line.

0 of 1 found

bash

aws sso login --profile my-dev-profile

SSO authorization page has automatically been opened in your default browser.

Follow the instructions in the browser to complete this authorization request.

Successfully logged into Start URL: https://my-sso-portal.awsapps.com/start

The browser asks you to approve, with MFA. The CLI then keeps short-lived badges in a cache. No key is saved in a file.

Predict

This terminal has AWS_PROFILE=shop set. Kancil runs a command with --profile practice. Which account does it use?

Check

Some files are settings. Some are secrets. Sort them.

Drag a card into a box. Or tap the card, then tap the box.

You did it!

You can now sign in with a profile and check who you are.

Go deeper (optional)

Not using Identity Center? Since AWS CLI 2.32.0, aws login uses your console sign-in instead. It refreshes short-lived badges for up to 12 hours. No access keys needed.

Real rep (no resources, no cost; budget alarm already set):

Real mission

Install AWS CLI version 2 from the official guide.
Check it works.
aws --version
Identity Center: set up a profile.
aws configure sso
Or, with an IAM user: sign in with your console login.
aws login
Ask who you are.
aws sts get-caller-identity
List your profiles.
aws configure list-profiles

0 of 6 steps done · Your ticks are saved.