I believe you are on the right track. Kettle simply uses the java SDK from Amazon. So the authentication options cycle through in order as specified here.
https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html
Not as familiar with CE, but double check your VFS connection set up. The region selection is in that dialog an may be overriding the credentials file.