It seems that setting:

pulumi config set aws:profile <PROFILE>

does result in a setting in Pulumi.stack.yaml, but it doesn't get used. It keeps using the "`default`" aws profile. If I set the environment variable AWS_PROFILE it then works. Is there some config I'm missing to get

config:
  aws:profile: <profile>

to be used for the default profile?

Are you constructing an instance of aws.Provider in your code? Can you paste the code here?

For some projects I am. But I was hoping that the config setting aws:profile would impact the default profile - i.e. no code required.

aws configure list-profiles

does show the profile I want to use.

The config setting does work for the default provider (i.e., when you don't construct an instance of aws.Provider). If you do construct a provider, you need to grab the config and pass it in yourself. For example, in this case I'm choosing to not pass in the profile:

const awsConfig = new pulumi.Config("aws");
const  aws = new Provider("aws", {
  region: awsConfig.getString("region"),
}

So (if I recall correctly..) this falls back on defaults. You would need this to ensure your expected behaviour:

const awsConfig = new pulumi.Config("aws");
const  aws = new Provider("aws", {
  region: awsConfig.getString("region"),
  profile: awsConfig.getString("profile"),
}

Or is it that the aws:profile is used after initial startup of Pulumi - but a profile still needs to allow certain access (e.g. [default]) to kick things off?

Not sure what you're thinking of there, do you have an example? I'm not aware of anything happening "before" Pulumi. When I set

pulumi:disable-default-providers:
 - aws

I don't have to do anything special "before" to get AWS providers to work

most likely you have env vars defined, which have higher precedence

Ooo good one. Try

unset AWS_PROFILE

Ok, I have found that it is being used to a degree. I have:

config:
  aws:profile: dev-iotcontrol-deployment

If I either comment out the profile dev-iotcontrol-deployment in my .aws/credentials file, or change the aws:profile setting to a non-existent profile I get

error: pulumi:providers:aws resource 'default_6_83_2' has a problem: unable to validate AWS credentials.
    Details: failed to get shared config profile, zzdev-iotcontrol-deployment

But also if I comment out my "[default]" entry in .aws/credentials, I get

error: read ".pulumi/meta.yaml": blob (key ".pulumi/meta.yaml") (code=Unknown): NoCredentialProviders: no valid providers in chain. Deprecated.
	For verbose messaging see aws.Config.CredentialsChainVerboseErrors

But setting AWS_PROFILE stops this complaint.

export AWS_PROFILE=dev-iotcontrol-deployment

You're using AWS KMS for your Pulumi secrets?

This project has no secrets.

You're not setting secretsprovider to awskms in the Pulumi config? That might have been it...

No mention of kms in Pulumi.yaml or the stack ones.

Hmm. Don't know why something is falling back to the default AWS creds then. Maybe try that verbose messaging thing at aws.Config.CredentialsChainVerboseErrors. I've never seen that message before.

I tried that. It didn't provide any extra information.

What does your ~/.pulumi/meta.yaml look like? Mine is just

version: 1

Maybe you can delete it and try again? Pulumi should re-create it.