Move the network cred check to last

We first check the env vars, then the `~/.aws-keys` file, finally we query the network host which has a timeout.

**Not yet tested on an IAM machine**, but it should be fine.