I believe you are on the right track. Kettle simply uses the java SDK from Amazon. So the authentication options cycle through in order as specified here.
Not as familiar with CE, but double check your VFS connection set up. The region selection is in that dialog an may be overriding the credentials file.