You never typed a password or a key, yet every command so far was signed as admin. Before each command, the CLI reads two files in your home directory.

Both are plain text, split into sections called profiles. The one in use when you name none is [default]. This is ~/.aws/config:

[default]
region = us-east-1
output = json

credentials holds an access key for admin: an id and a secret. AWS checks the signature on every request against it. Chapter 2 makes keys for other users.

Reading the settings

aws configure list

This shows each setting and where it came from: the config file, the credentials file, or the environment.

aws configure get region

get prints one setting from the default profile.

Changing a setting

aws configure set output table

set writes the setting into ~/.aws/config, and every command after it uses it. The next lesson explains the output formats. A parameter on a command, such as --region, still overrides the file for that one command.