Profiles and regions

How rolle writes AWS profiles, and how to rename them or change their region.

The profile model

Every active AWS session is a profile in ~/.aws/config backed by credential_process. The process is the rolle binary. It returns cached credentials and never writes them into the file.

[default]
region = us-east-1
credential_process = /path/to/rolle creds <session-id>
rolle_session = <session-id>

Every session writes the profile default unless you set a name, so aws and every SDK work without --profile.
Two sessions can share a profile name. Starting one stops the other.
rolle refuses to overwrite a profile that holds real credential keys, and it restores a plain [default] section (region and output) when the session stops.

Rename a profile

Click the profile name in the session table, or use the row menu Set AWS profile name. Names match [A-Za-z0-9_.-]+. An empty name restores default.

rolle session profile "Acme Prod/AdministratorAccess" acme-prod
rolle session profile "Acme Prod/AdministratorAccess"          # back to default
aws sts get-caller-identity --profile acme-prod

Change a region

Click the region in the session table, or use the row menu Change region. An active session rewrites its profile at once.

rolle session region "Acme Prod/AdministratorAccess" eu-west-1

New sessions take their region from Settings → General → Default region.