for those using /vsis3/ I've just committed a few improvements regarding how credentials are handled.
Best is to quote the updated documentation:
The AWS_SECRET_ACCESS_KEY and AWS_ACCESS_KEY_ID configuration options *must*
be set. The AWS_SESSION_TOKEN configuration option must be set when
temporary credentials are used. The AWS_REGION (or AWS_DEFAULT_REGION
starting with GDAL 2.3) configuration option may be
set to one of the supported regions and defaults to 'us-east-1'.
Starting with GDAL 2.3, alternate ways of providing credentials similar to
what the "aws" command line utility or Boto3 support can be used. If the
above mentionned environment variables are not provided, the
~/.aws/credentials or %UserProfile%/.aws/credentials file will be read. The profile may be specified with the AWS_PROFILE environment variable (the default profile is "default")
The ~/.aws/config or %UserProfile%/.aws/config file may also be used to
retrieve credentials and the AWS region.
If none of the above method succeeds, instance profile credentials will be
retrieved when GDAL is used on EC2 instances.
Spatialys - Geospatial professional services