Permission error during AWS CLI configuration

bbk · January 29, 2026, 5:33am

Recently we have started seeing “permission denied” error when AWS CLI is being configured.

It seems like /home/circleci/.aws directory is created as root:root.

Later when aws configure is called it fails with:

(Step called “Install AWS CLI - latest” works successfully)

(Step: “Configure AWS Access Key ID“ fails)

[Errno 13] Permission denied: '/home/circleci/.aws/credentials'

Exited with code exit status 255

Image: cimg/python:2.7.18

Orb: circleci/aws-cli@5.4.1 using aws-cli/setup

As far as I can tell there are no changes on our side recently.

Seems like aws-cli orb is also not recently updated.

Perhaps something has changed in the image?

agarov · January 29, 2026, 10:19am

This is due to a bug in the latest version of the AWS CLI.
You can see the issue here :

github.com/aws/aws-cli

v2.33.9: Permission denied on ~/.aws/config when running as non-root user after initialization

ouvert 01:16AM - 29 Jan 26 UTC

seanuleh

bug needs-triage potential-regression

### Describe the bug AWS CLI v2.33.9 creates `~/.aws` directory with root owner…ship when `aws --version` is executed with elevated privileges. This causes "Permission denied" errors for non-root users attempting to run subsequent AWS CLI commands. This is a regression from v2.33.8 where `aws --version` had no side effects. ## Environment - **AWS CLI Version**: 2.33.9 (broken) vs 2.33.8 (working) - **Platform**: Linux (ARM64) - **OS**: Ubuntu 22.04 - **User Context**: AWS CLI installed and verified as root, but run as non-root user - **Installation Method**: Any method that verifies installation with `sudo aws --version` ## Issue Description When `aws --version` is executed with root privileges (e.g., `sudo aws --version` or during installation verification), AWS CLI v2.33.9 creates the `~/.aws/cli/cache/` directory structure with root ownership. This prevents non-root users from running any AWS CLI commands that need to write to `~/.aws/config` or `~/.aws/credentials`. **Critical Finding**: `aws --version` should be a read-only operation with zero side effects. In v2.33.8 it was. In v2.33.9 it creates directories and files. Error messages: ``` [Errno 13] Permission denied: '/home/runner/.aws/config' [Errno 13] Permission denied: '/home/runner/.aws/credentials' ``` This issue does NOT occur with AWS CLI v2.33.8. ### Regression Issue - [x] Select this option if this issue appears to be a regression. ### Expected Behavior **After running `sudo aws --version`:** ```bash $ ls -la ~/ | grep .aws # No output - no .aws directory created ✅ ``` **After running `aws configure set region us-east-2 --profile test` as non-root user:** ```bash $ ls -la ~/.aws/ drwxr-xr-x. 2 user user 20 Jan 29 00:53 . -rw-------. 1 user user 34 Jan 29 00:53 config ``` - `aws --version` has **zero side effects** - no directories created ✅ - `~/.aws` directory created only when needed, owned by the actual user ✅ - No cache subdirectories created during simple operations - All subsequent AWS CLI commands succeed ### Current Behavior **After running `sudo aws --version`:** ```bash $ ls -la ~/.aws/ drwxr-xr-x. 3 root root 17 Jan 29 00:50 . drwxr-xr-x. 3 root root 19 Jan 29 00:50 cli $ ls -la ~/.aws/cli/ drwxr-xr-x. 3 root root 19 Jan 29 00:50 . drwx------. 2 root root 24 Jan 29 00:50 cache ``` **After running `aws configure set region us-east-2 --profile test` as non-root user:** ``` [Errno 13] Permission denied: '/home/user/.aws/config' ``` ### Reproduction Steps ### Simple Reproduction ```bash # As root, run version check (simulating installation verification) sudo -E aws --version # As non-root user, try to configure AWS CLI aws configure set region us-east-2 --profile test # Result: [Errno 13] Permission denied: '/home/youruser/.aws/config' ``` ### GitHub Actions Reproduction ```yaml - name: Install AWS CLI run: | curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64-2.33.9.zip" -o "awscliv2.zip" unzip awscliv2.zip sudo ./aws/install # Installation verification runs: sudo aws --version # This creates /home/runner/.aws/cli/cache/ as root:root - name: Configure AWS CLI run: | # This fails because ~/.aws is now owned by root aws configure set region us-east-2 --profile test ``` ### Possible Solution _No response_ ### Additional Information/Context **PR #10013 triggers cache/history initialization too eagerly.** Even running `aws --version` now creates the `~/.aws/cli/cache/` directory structure. This is problematic because: 1. `aws --version` is commonly run as root during installation verification 2. When run with elevated privileges, it creates `~/.aws/cli/cache/` with root ownership 3. The cache directory gets restrictive `0o700` permissions 4. When the actual user tries to use AWS CLI, they cannot write to their own `~/.aws/` directory ### CLI version used 2.33.9 ### Environment details (OS name and version, etc.) Github Actions - arm64 runner

To fix it you can specify the aws cli version parameter like this :

      - aws-cli/setup:
          version: "2.33.8"

Topic		Replies	Views
Having problems accessing AWS credentials with awscli Build Environment awscli , aws , s3 , circle-yml	2	6559	June 18, 2018
Can't get awscli to work Build Environment awscli , config	1	3124	April 6, 2021
Error `The config profile (default) could not be found` when configuring AWS CLI Deployments	0	5401	August 18, 2022
AWS Permissions are gone, but the values are still available in build environment Build Environment awscli , aws	9	4890	April 21, 2019
Aws-s3@1.0.4 not working: Unable to install AWS CLI. Please install pip. Error Orbs awscli , pip , aws	8	7701	March 17, 2019

Permission error during AWS CLI configuration

Related topics