aws Unable to locate credentials aws configure

Not specified by the original author.

Unable to locate credentials. You can configure credentials by running 'aws configure'

TL;DR: the CLI found no credentials anywhere it looks. Run aws configure and enter your access key pair, or if your org uses SSO run aws sso login --profile [profile]. Nine times out of ten the fix is either never having run aws configure, or AWS_PROFILE pointing at a profile that doesnt exist.

Unable to locate credentials. You can configure credentials by running "aws configure".

Steps

1. Confirm the failure:

aws sts get-caller-identity

Expected on success: JSON with UserId, Account, and Arn. If it errors the same way, keep going.

2. Check which profile is active and where values come from:

aws configure list

Expected: shows the profile name and the source of each value (env, config file, or none).

3. Set credentials. Static keys:

aws configure

Expected: prompts for AWS Access Key ID, AWS Secret Access Key, region, and output format. SSO instead:

aws sso login --profile [your profile]

Expected: browser opens for SSO, then the CLI reports a successful login.

4. Verify:

aws sts get-caller-identity

Expected: returns your identity with no error.

When this applies

• any aws command fails with the exact Unable to locate credentials error
• fresh install where aws configure was never run
• new shell where the env vars were not exported, or AWS_PROFILE names a profile with no keys
• SSO session expired

When it doesnt

• InvalidClientTokenId: The security token included in the request is invalid — the key is deleted, deactivated, or mistyped; recreate it in IAM and re-run aws configure
• ExpiredToken — refresh SSO or the temporary credentials
• AccessDenied on a specific call — identity is fine, the IAM policy is missing the action

Compatibility

AWS CLI v2 (v1 from distro repos is retired). Same chain on Linux, macOS, and Windows.

Why it happens

The CLI checks credentials in a fixed order: environment variables, the shared credentials file, SSO cache, then container or instance metadata. If none yields a key it raises this instead of guessing. The classic traps: AWS_PROFILE pointing nowhere, env vars set in one terminal but not another, and an SSO login that expired silently.

Edge cases

• ~/.aws/credentials stores the secret in plain text: chmod 600 it and never commit it
• a typo in the env var name is a top cause — it must be exactly AWSSECRETACCESS_KEY
• system clock skew shows up as SignatureDoesNotMatch, not this error
• in containers and EC2, prefer IAM roles over static keys so there is nothing to locate

Find this skill again

curl -s 'https://vectle.com/api/v1/search?q=aws+unable+to+locate+credentials'

AWS CLI users repeatedly hit Unable to locate credentials when no credentials exist in any of the places the CLI checks: environment variables, the shared credentials file, an instance profile, or an assumed role. The verified fix: run aws configure (or aws sso login --profile for SSO setups) and confirm with aws sts get-caller-identity, watching for the common traps of a wrong AWS_PROFILE or a typo in the env var name. Source: https://github.com/abdullahbinamin/devops-training-practical-notes/blob/HEAD/terraform/Day-01-Terraform-Fundamentals-and-Setup/04-aws-cli-setup.md

Not specified by the original author.

TL;DR: boto3 looked in every credential source (env vars, shared credentials file, IAM role) and found nothing. Run aws configure or export AWSACCESSKEYID and AWSSECRETACCESSKEY, then retry. If you are on EC2/Lambda/ECS, attach an IAM role instead.

botocore.exceptions.NoCredentialsError: Unable to locate credentials

Fix it

1. Check what boto3 sees: run aws sts get-caller-identity. Expected on success: your account ARN. If it errors, credentials are missing or broken.
2. Local dev: run aws configure and enter your access key id, secret access key, and region. Expected: ~/.aws/credentials now has a [default] profile.
3. Or set env vars in your shell session: export AWSACCESSKEYID to your key id and AWSSECRETACCESSKEY to your secret, plus AWSDEFAULTREGION. Expected: the sts call succeeds.
4. On EC2, ECS, or Lambda: do not use static keys; attach an IAM role/instance profile with the needed permissions. Expected: boto3 picks up role credentials automatically.

When this applies

• The error is exactly NoCredentialsError: Unable to locate credentials.
• The same code works on another machine (that machine has credentials configured).

When it doesn't

• The error is InvalidClientTokenId or SignatureDoesNotMatch: credentials exist but are wrong; check the key values.
• The error is AccessDenied: credentials are fine but lack permission; fix the IAM policy.

Compatibility

• boto3/botocore any version. AWS CLI v1/v2 for the aws configure step.

Why it happens

boto3 resolves credentials through a chain: explicit args, env vars, shared credentials file, container credentials, instance metadata. NoCredentialsError means every link came up empty.

Edge cases

• PartialCredentialsError (only one of the pair set) is a different error with a different fix: set both.
• In Docker, env vars set at build time are not visible at runtime unless passed in; check docker run -e.
• SSO-based setups need aws sso login first; the credentials file alone is not enough.

Reported in a troubleshooting doc (doc:pythonpool.com NoCredentialsError guide): botocore.exceptions.NoCredentialsError: Unable to locate credentials - fix guide. The verified fix: Asked on Stack Overflow by developers getting NoCredentialsError on code that worked for teammates. The verified answer: boto3 found no credentials in any of its lookup locations, so configure them via aws configure, environment variables, or an IAM role, in that precedence order. Source: the linked Stack Overflow thread. Source: https://www.pythonpool.com/botocore-exceptions-nocredentialserror-unable-to-locate-credentials/ Thread ref: doc:pythonpool.com NoCredentialsError guide

Not specified by the original author.

The profile name does not match anything in your config. List your profiles with aws configure list-profiles, fix the typo, and make sure named profiles in ~/.aws/config use the [profile my-profile] header (only [default] goes bare). If AWS_PROFILE is set to an empty string, unset it entirely.

The config profile (my-profile) could not be found

Fix

1. List the profiles the CLI actually sees:

   aws configure list-profiles

   Expected: the profile name you want appears exactly, character for character.

2. If it is missing, check ~/.aws/config. Named profiles need the prefix:

   [profile my-profile]
   region = us-east-1

   Only [default] goes without the profile prefix. Fix the header, save, retry.

3. Check the right file: SSO, role_arn, and source_profile settings belong in ~/.aws/config; static IAM keys belong in ~/.aws/credentials. A profile split across the wrong files will not resolve.

4. If the error shows empty parentheses - The config profile () could not be found - your AWS_PROFILE is set to an empty string, which counts as a profile name. Fix it:

   unset AWS_PROFILE

   Expected: aws sts get-caller-identity falls back to the default profile and works.

When this applies

• Any aws command fails with The config profile (name) could not be found, including the empty-parens variant.
• You just edited ~/.aws/config or set AWS_PROFILE in a new shell.

When it does NOT apply

• Unable to locate credentials: the profile resolves but has no credentials.
• ExpiredToken / InvalidClientTokenId: the profile resolves but the credentials are bad.

Compatibility

• AWS CLI v1 and v2. The [profile name] header rule applies to ~/.aws/config in both.

Why it happens

The CLI looks up the profile name in ~/.aws/config (and ~/.aws/credentials for keys). A typo, a missing profile prefix in the section header, or an AWS_PROFILE value that does not exist anywhere means the lookup finds nothing. The empty-string case is sneaky: export AWS_PROFILE="" sets a real (empty) name instead of clearing the variable.

Edge cases

• AWS_CONFIG_FILE / AWS_SHARED_CREDENTIALS_FILE env vars can point the CLI at different files than the ones you edited. Check them with env | grep AWS_.
• Profile names are case-sensitive.
• On Windows, the files live under %UserProfile%\.aws.

This is one of the most reported AWS CLI config errors. The towardsthecloud AWS CLI profiles guide documents the error 'The config profile (my-profile) could not be found' with causes: typo in the profile name, the missing [profile my-profile] prefix in ~/.aws/config (only [default] goes without the prefix), and the profile living in the wrong file (SSO/role configs belong in ~/.aws/config, IAM keys in ~/.aws/credentials). The devopscert202 terraform-ansible-labs guide independently documents a sharp variant: 'export AWSPROFILE=""' (empty string) counts as a real profile name, so every command fails with 'The config profile () could not be found' - the fix is 'unset AWSPROFILE', not setting it empty. Source: https://towardsthecloud.com/blog/aws-cli-switch-profiles