[proton0210]

Description

Add a global --profile flag so commands such as agentcore deploy --profile development select the named AWS shared configuration profile. Profile credentials override ambient static keys, while explicit target credentials remain authoritative. Region precedence remains --region, environment, selected profile, then the default.

Selection is scoped to the command's asynchronous work. SDK client caches, deployment credentials, STS account lookup, Bedrock Agent import, child tools, and local containers receive the selection without changing the parent environment. Container development mounts explicitly configured shared files read-only. Telemetry uses the selected profile's region for its China-region gate. README examples and the generated command reference are included.

Child tools still need to support the profile's authentication mechanism in their own runtime; a host-specific credential_process executable is not copied into containers.

Related Issue

Closes #1727

Documentation PR

Documentation is included here.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

• bun test: 4,730 passed, five Windows-only tests skipped on macOS; six snapshots passed.
• Relevant end-to-end validation: the built Node 22 bundle signed five requests to a local HTTP endpoint using the selected profile and effective region. Seven smoke checks covered flag placement, equals syntax, region precedence, missing profiles without ambient-credential fallback, and missing flag values. Live AWS deployment tests were not run because they provision resources; credential and deployment boundaries were verified locally.
• bun run typecheck
• bun run lint:check
• bun run format:check
• bun run build
• bun run secrets:check
• bun install --frozen-lockfile
• Assets changed: not applicable.

Regression coverage includes concurrent and nested command scopes, selected-profile client caching, explicit target credentials, STS signing, assume-role region selection, credential_process session credentials, subprocess environment isolation, custom container configuration files, empty profile validation, and China-region telemetry suppression.

bun run audit reports nine advisories already present in the dependency tree (one high, four moderate, four low). This change declares the already-locked credential provider as a direct dependency and does not change resolved dependency versions.

Checklist

• I have read the CONTRIBUTING document
• I have added tests for the feature and failure paths
• I have updated the documentation
• I have added an appropriate example
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.