aws loginしてもdefaultのcredentialsが優先される場合の対処法と認証情報の優先順位

# デフォルトの状態を確認
% aws sts get-caller-identity
{
    "UserId": "AIDAAAAAAAAAAAAAAAAAA",
    "Account": "999999999999",
    "Arn": "arn:aws:iam::999999999999:user/default-credentials-user"
}
# ログインする
% aws login
Attempting to open your default browser.
If the browser does not open, open the following URL:
[中略]
Updated profile default to use arn:aws:sts::999999999999:assumed-role/login-role/login-role credentials.
# ログイン後の認証情報を確認する
% aws sts get-caller-identity
{
    "UserId": "AIDAAAAAAAAAAAAAAAAAA",
    "Account": "999999999999",
    "Arn": "arn:aws:iam::999999999999:user/default-credentials-user" # 変わっていない
}

% aws configure list
NAME       : VALUE                    : TYPE             : LOCATION
profile    : <not set>                : None             : None
access_key : ****************XXXX     : shared-credentials-file :
secret_key : ****************YYYY     : shared-credentials-file :
region     : ap-northeast-1           : config-file      : ~/.aws/config

# プロファイルを指定したaws login
% aws login --profile override
No AWS region has been configured. The AWS region is the geographic location of your AWS resources.

If you have used AWS before and already have resources in your account, specify which region they were created in. If you have not created resources in your account before, you can pick the region closest to you: https://docs.aws.amazon.com/global-infrastructure/latest/regions/aws-regions.html.

You are able to change the region in the CLI at any time with the command "aws configure set region NEW_REGION".
AWS Region [us-east-1]: ap-northeast-1 # リージョンの設定を入れる
Attempting to open your default browser.
If the browser does not open, open the following URL:
[中略]
Updated profile override to use arn:aws:sts::999999999999:assumed-role/login-role/login-role credentials.
Use "--profile override" to use the new credentials, such as "aws sts get-caller-identity --profile override"
# プロファイル無しで動作確認、引き続きデフォルトが優先された
% aws sts get-caller-identity
{
    "UserId": "AIDAAAAAAAAAAAAAAAAAA",
    "Account": "999999999999",
    "Arn": "arn:aws:iam::999999999999:user/default-credentials-user"
}
% aws configure list
NAME       : VALUE                    : TYPE             : LOCATION
profile    : <not set>                : None             : None
access_key : ****************XXXX     : shared-credentials-file :
secret_key : ****************YYYY     : shared-credentials-file :
region     : ap-northeast-1           : config-file      : ~/.aws/config
# プロファイルを指定するとaws loginの認証情報が使えた
% aws sts get-caller-identity --profile override
{
    "UserId": "AROAIAAAAAAAAAAAAAAAA:cm-usuda.keisuke",
    "Account": "999999999999",
    "Arn": "arn:aws:sts::999999999999:assumed-role/login-role/login-role"
}
# TYPEがloginとなる
% aws configure list --profile override
NAME       : VALUE                    : TYPE             : LOCATION
profile    : override                 : manual           : --profile
access_key : ****************DDDD     : login            :
secret_key : ****************EEEE     : login            :
region     : ap-northeast-1           : config-file      : ~/.aws/config

# 中身を空っぽに
% vi .aws/credentials
# 優先順位が変わった
% aws configure list
NAME       : VALUE                    : TYPE             : LOCATION
profile    : <not set>                : None             : None
access_key : ****************DDDD     : login            :
secret_key : ****************EEEE     : login            :
region     : ap-northeast-1           : config-file      : ~/.aws/config
# プロファイル無しでaws loginの認証情報に変わった
% aws sts get-caller-identity
{
    "UserId": "AROAIAAAAAAAAAAAAAAAA:cm-usuda.keisuke",
    "Account": "999999999999",
    "Arn": "arn:aws:sts::999999999999:assumed-role/login-role/login-role"
}