AWS CLI 'Could not connect to the endpoint URL' - how do I check region and endpoint settings?

Cause: The AWS CLI builds the request URL from the service, the Region and any endpoint override. If the Region is wrong or unset for the resource, the service is unavailable in that Region, or a custom endpoint is set (for example a leftover local-emulator URL, a VPC endpoint, or a FIPS/dual-stack setting that does not exist for that service and Region), the CLI will try an address that does not answer. Network controls such as a proxy or firewall can also block the connection. The AWS docs note that errors or unexpected results occur when a service is not available in the chosen Region or resources are in another Region. Fix: 1. See which Region applies. Precedence is: the --region option, then AWS_REGION, then AWS_DEFAULT_REGION, then the region setting of the profile. Run aws configure list (add --profile NAME) to see the value and where it came from, and set the right one, for example export AWS_DEFAULT_REGION=us-west-2 or aws s3 ls --region us-west-2. 2. Look for endpoint overrides. Highest precedence first: --endpoint-url, AWS_IGNORE_CONFIGURED_ENDPOINT_URLS, service-specific AWS_ENDPOINT_URL_<SERVICE> variables, then AWS_USE_DUALSTACK_ENDPOINT, AWS_USE_FIPS_ENDPOINT and AWS_ENDPOINT_URL, then the config file (endpoint_url in a services section or profile). Run env | grep AWS_ and check ~/.aws/config for endpoint_url lines. Unset or remove stale values, or test with AWS_IGNORE_CONFIGURED_ENDPOINT_URLS=true. 3. If you enabled FIPS or dual-stack endpoints, disable them or give an explicit --endpoint-url, because a service may lack such an endpoint in some Regions. 4. Run the command with --debug and read the URL it tries and the connection error. Confirm DNS resolution and outbound HTTPS access from that machine to that URL. 5. If a proxy is required, configure HTTPS proxy settings for the CLI. If you get certificate verification errors with a TLS-inspecting proxy, point the CLI to your organization's CA bundle with the AWS_CA_BUNDLE variable, the ca_bundle setting or --ca-bundle; do not turn verification off. 6. Update to a recent AWS CLI version if the service or Region is new. Verify: aws sts get-caller-identity --region REGION succeeds, and the --debug output shows the intended endpoint host for your service call. Sources: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.html https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-endpoints.html