Separate AWS credentials per project on Windows (cmder + Git Bash)

I do consulting work for a client and I'm also exploring AWS on my own, and the two need different credentials. Part 1 used --profile pokesandbox, but I wanted something where I couldn't accidentally run a command against the wrong account. My solution is one config file per project, selected by the terminal tab I open.

One config file per project

Each project directory gets its own .aws/config:

[default]
region = us-east-1
output = json
aws_access_key_id = AKIXXXXXXXXXXXXXXXXX
aws_secret_access_key = <secret_key>

The CLI also accepts keys in the config file, so I use a single file per project instead of splitting config and credentials. Add .aws/ to .gitignore, because this file now contains secrets.

Pointing the CLI at it

The CLI reads AWS_CONFIG_FILE before falling back to ~/.aws/config. I set it in a cmder task (Settings > Startup > Tasks):

-new_console:t:"PokeData":d:"C:\PokeData\" set "PATH=%ConEmuDir%\..\git-for-windows\usr\bin;%PATH%" & %ConEmuDir%\..\git-for-windows\git-cmd.exe --no-cd --command=%ConEmuBaseDirShort%\conemu-msys2-64.exe "%ConEmuDir%\..\git-for-windows\usr\bin\bash.exe" --login -i -c 'export AWS_CONFIG_FILE="/c/PokeData/.aws/config"; exec bash --login -i'

The part that matters is export AWS_CONFIG_FILE="/c/PokeData/.aws/config". The rest opens a Git Bash tab, titled "PokeData", starting in C:\PokeData\. The context comes from the tab, not the directory: the CLI doesn't detect where you are, the tab just has the variable set.

Checking which identity you're using

In the PokeData tab:

λ aws sts get-caller-identity
{
    "UserId": "AIDAXXXXXXXXXXXXXXXXX",
    "Account": "111111111111",
    "Arn": "arn:aws:iam::111111111111:user/PokeSandbox-Dev"
}

In a client tab:

λ aws sts get-caller-identity
{
    "UserId": "AIDAXXXXXXXXXXXXXXXXX",
    "Account": "222222222222",
    "Arn": "arn:aws:iam::222222222222:user/client-user"
}

Now I can operate in two different contexts without having to think about it.