Honor %UserProfile% for credentials on Windows (?)

[CloudViking86]

My local computer account: "MyUser" (which is a part of the local "Administrators" group)

On Windows 10 Pro (yes I know it isn't officially supported but SSM reports the OS fine in "Inventory"):
"Administrator" account is disabled by default, no C:\Users\Administrator folder

On Windows Server 2012 R2 and onward:
"Administrator" account is enabled by default, C:\Users\Administrator exists

Following this guide to specify IAM-credentials and region for OnPrem "server":
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-on-premise.html#install-CloudWatch-Agent-iam_user-SSM-onprem

aws configure --profile AmazonCloudWatchAgent
^ This requires AWS CLI whereas AWS PowerShell would have been a better example to give for a Windows-host however "aws configure" doesn't seem to have a PowerShell eqv?;
https://aws-cli-eq-pwsh.shibata.tech/configure/

anyway running that CLI-command creates the following dir and files:

C:\Users\MyUser\.aws\
C:\Users\MyUser\.aws\config
C:\Users\MyUser\.aws\region

when then trying to launch CWA it fails with:

****** processing amazon-cloudwatch-agent ******
Got Home directory: C:\Users\Administrator
I! Set home dir windows: C:\Users\Administrator
I! SDKRegionWithCredsMap region:
Unable to determine aws-region.
Please make sure the credentials and region set correctly on your hosts.

So it defaults to "C:\Users\Administrator" which is a non-existing dir and does not contain the "config" or "region" AWS credential files.
What I did was to mmove the ".aws"-folder from
C:\Users\MyUser\.aws\
to
C:\Users\Administrator\.aws\

According to this documentation:
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html
"aws configure" uses the environment variable %UserProfile% in Windows so CloudWatch should look there as well for the credentials?

[haojhcwa]

Unfortunately, this has been a known behavior of the agent and to remain backward compatibility and not breaking existing customers, we cannot change this easily. Even adding the user credentials as a fall back could affect some customers who previously left some credentials in their own home folder and didn't expect agent to pick it up.

You should be able to specify the credential via the common-config.toml file documented here:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/install-CloudWatch-Agent-commandline-fleet.html#CloudWatch-Agent-profile-instance-first

[davidkhala]

I see the same issue so I try to follow the workaround of setting common-config-toml. Instead of doing so mannualy, below scripts can help to automate a little.

pip install toml-cli # Prerequisite

toml add_section --toml-path C:\ProgramData\Amazon\AmazonCloudWatchAgent\common-config.toml credentials
toml set --toml-path C:\ProgramData\Amazon\AmazonCloudWatchAgent\common-config.toml credentials.shared_credential_profile default # replace `default` with your target profile
toml set --toml-path C:\ProgramData\Amazon\AmazonCloudWatchAgent\common-config.toml credentials.shared_credential_file $env:USERPROFILE\.aws\credentials