AWS CLI configuration: Get with the AWS CLI

Part 1128 of AWS from Zero.

What we are learning

aws configure get prints one configuration value from the AWS config file. It is the scripting-safe way to read settings: one value, no table, no secrets you did not explicitly ask for. The command supports two addressing styles. An unqualified name such as region is scoped to the currently active profile. A qualified name contains at least one dot and names its section explicitly: default.region reads the default profile and profile.<name>.<setting> reads any named profile, ignoring whichever profile is currently active.

The boundary to internalize before using it in automation: aws configure get reads only the config file. It does not resolve environment variables, command-line options, or role credentials, so it answers "what is written in this file section" rather than "what will the CLI use right now". Those are different questions with different tools.

Before you run it

export AWS_PROFILE="aws-zero-sandbox"
export AWS_REGION="ap-south-1"
aws sts get-caller-identity
aws configure get region

You need a sandbox profile whose section exists in ~/.aws/config. No IAM permissions are involved because configure get never contacts AWS; the identity check above is the only network call in this lab. The command is not regional, has no service quota, and reads a saved file immediately rather than waiting for eventual consistency. The values you read can include credentials if you ask for them by name, so keep this lab's reads to non-secret settings and never pipe credential values into logs.

Cost note: aws configure get is a local, read-only command with no AWS charge. The single aws sts get-caller-identity call is also free, and nothing in this lab creates a resource.

The command

aws configure get region

The input shape is a single positional varname plus an optional --profile. With the unqualified name region and AWS_PROFILE exported, the command looks up the region key inside the [profile aws-zero-sandbox] section of the config file and prints the bare value with no formatting. There is no pagination and no JSON envelope: the output is the value itself, or nothing at all when the key is absent.

Inspect the result

aws configure get profile."$AWS_PROFILE".region
echo $?

Verification here is exit-code discipline. The qualified read must print the same value as the unqualified read and exit 0. That pair of observations proves two things at once: the value exists in the file, and it lives in the profile section you intended rather than being inherited from somewhere else. Any mismatch between the two forms means your active profile is not the profile you think it is.

One tiny variation

aws configure get output
echo $?

Only the variable name changed: output instead of region, same profile, same addressing rules. If your sandbox profile has never set an output format, this prints nothing and exits 1, which is a correct and useful answer, not a malfunction. This is the shape of configure get in scripts: capture the value, branch on the exit code, and never assume a default was written to disk.

Common mistake

Treating empty output as a bug because "the CLI clearly has a Region". The documented behavior is that a lookup of a missing key or section prints nothing and returns exit code 1; meanwhile the same shell shows a working Region because AWS_REGION is exported. The diagnostic evidence is exactly those two facts together: aws configure get region gives an empty string with echo $? printing 1, while aws configure list shows a region row with type env. Use configure list when you need the effective value and configure get when you need the value persisted in the selected file section. Scripts that ignore the exit code can silently propagate an empty string into later commands, which then fail far from the real cause.

Cleanup

aws configure get region
echo $?

There is nothing to undo: every command in this lesson is a read. The final value and exit code should match the first configure get run, proving that the selected config section was not changed.

Where this goes later

Next: AWS CLI configuration: List with the AWS CLI.