There is a very, very useful S3A authentication method that is not currently documented: com.amazonaws.auth.profile.ProfileCredentialsProvider
This provider lets you source your AWS credentials from a shared credentials file, typically stored under ~/.aws/credentials, using a named profile. All you need is to set the AWS_PROFILE environment variable, and the provider will get the appropriate credentials for you.
I discovered this from my coworkers, but cannot find it in the docs for hadoop-aws. I'd expect to see it at least mentioned in this section. It should probably be added to the docs for every minor release that supports it, which I'd guess includes 2.8 on up.
(This provider should probably also be added to the default list of credential provider classes, but we can address that in another ticket. I can say that at least in 2.9.2, it's not in the default list.)
(This is not to be confused with com.amazonaws.auth.InstanceProfileCredentialsProvider, which serves a completely different purpose.)