Using your credentials

Once a profile is signed in, its temporary role credentials can reach your tools three ways. Most of the time you want the first one, because it needs no configuration at all.

At the standard metadata address

Turn on the default endpoint and pick the profile it serves. It answers at http://169.254.169.254, the address the AWS SDKs already try. Nothing else to set — no AWS_PROFILE, no endpoint override.

$ aws sts get-caller-identity
{ "Arn": "arn:aws:sts::111122223333:assumed-role/OrgAdmin/quorra" }

At a custom endpoint

Additional endpoints listen on 127.0.0.1 with a port you choose. Point a compatible client at one when you want an explicit profile per shell.

export AWS_EC2_METADATA_SERVICE_ENDPOINT=http://127.0.0.1:9678

export AWS_EC2_METADATA_SERVICE_ENDPOINT=http://127.0.0.1:9678

set -gx AWS_EC2_METADATA_SERVICE_ENDPOINT http://127.0.0.1:9678

$env:AWS_EC2_METADATA_SERVICE_ENDPOINT = "http://127.0.0.1:9678"

Quorra also publishes the active port at ~/Library/Application Support/Quorra/imds.port for local scripts.

As environment variables

Open a profile, choose your shell, and Copy env puts the exact export statements on the clipboard. Use this for a tool that reads credentials only from the environment.