Providing --profile is not enough, need to set env vars as well?

[JoshMcCullough]

Hello. Let's say I'm deploying a stack to the us-east-1 region using my some-iam profile. I do this:

cdk deploy --profile some-iam

And I set the region property of my stack to us-east-1 (really it's provided from the app's context). I get the error:

Need to perform AWS calls for account XXXXX, but no credentials have been configured

Looking at the verbose output, I see:

Setting "CDK_DEFAULT_REGION" environment variable to us-west-1
Resolving default credentials
Looking up default account ID from STS
Unable to determine the default AWS account (InvalidClientTokenId): The security token included in the request is invalid.

If I set my terminal to use the same profile/region, the following works:

export AWS_PROFILE=some-iam
export AWS_REGION=us-east-1

aws sts get-callery-identity

If I leave those env vars set and run the cdk deploy ... command again, it works.

---

Question: why do I have to set the AWS_PROFILE env var if I'm already passing the same profile via --profile?