Erring on the side of caution here as this could be a possible security issue.

Can someone perhaps more knowledgable than me comment on whether or not:
https://github.com/aws/aws-cli/blob/develop/awscli/customizations/configure/__init__.py#L14

Could be unintentionally causing aws-cli to import 'botocore.vendored.six' and thereby unintentionally import the vendored version of urllib3 from botocore, which has a known vulnerability?

$ python -v -m awscli
[...]
import 'botocore.vendored' # <_frozen_importlib_external.SourceFileLoader object at 0x10b9a3a58>
# /usr/local/lib/python3.7/site-packages/botocore/vendored/__pycache__/six.cpython-37.pyc matches /usr/local/lib/python3.7/site-packages/botocore/vendored/six.py
# code object from '/usr/local/lib/python3.7/site-packages/botocore/vendored/__pycache__/six.cpython-37.pyc'
# /usr/local/Cellar/python/3.7.3/Frameworks/Python.framework/Versions/3.7/lib/python3.7/__pycache__/__future__.cpython-37.pyc matches /usr/local/Cellar/python/3.7.3/Frameworks/Python.framework/Versions/3.7/lib/python3.7/__future__.py
# code object from '/usr/local/Cellar/python/3.7.3/Frameworks/Python.framework/Versions/3.7/lib/python3.7/__pycache__/__future__.cpython-37.pyc'
[...]
import 'botocore.vendored.six' # <_frozen_importlib_external.SourceFileLoader object at 0x10b9a3320>
[...]
# /usr/local/lib/python3.7/site-packages/botocore/vendored/requests/packages/urllib3/__pycache__/__init__.cpython-37.pyc matches /usr/local/lib/python3.7/site-packages/botocore/vendored/requests/packages/urllib3/__init__.py

I am not sure what danger this actually causes, as further down we can see:

import 'urllib' # <_frozen_importlib_external.SourceFileLoader object at 0x10bd38a90>
# /usr/local/Cellar/python/3.7.3/Frameworks/Python.framework/Versions/3.7/lib/python3.7/urllib/__pycache__/parse.cpython-37.pyc matches /usr/local/Cellar/python/3.7.3/Frameworks/Python.framework/Versions/3.7/lib/python3.7/urllib/parse.py

Here seems to be all the imports that come from vendored urllib3 via botocore.

python -v -m 'awscli' 2>&1| grep '^import ' | grep 'vendored.requests.packages.urllib3'
import 'botocore.vendored.requests.packages.urllib3.exceptions' # <_frozen_importlib_external.SourceFileLoader object at 0x104661320>
import 'botocore.vendored.requests.packages.urllib3.packages.ssl_match_hostname' # <_frozen_importlib_external.SourceFileLoader object at 0x104661d30>
import 'botocore.vendored.requests.packages.urllib3.packages' # <_frozen_importlib_external.SourceFileLoader object at 0x104661550>
import 'botocore.vendored.requests.packages.urllib3.packages.six' # <_frozen_importlib_external.SourceFileLoader object at 0x1046616d8>
import 'botocore.vendored.requests.packages.urllib3.util.connection' # <_frozen_importlib_external.SourceFileLoader object at 0x1047bcc88>
import 'botocore.vendored.requests.packages.urllib3.util.request' # <_frozen_importlib_external.SourceFileLoader object at 0x1047bce10>
import 'botocore.vendored.requests.packages.urllib3.util.response' # <_frozen_importlib_external.SourceFileLoader object at 0x1047bcef0>
import 'botocore.vendored.requests.packages.urllib3.util.ssl_' # <_frozen_importlib_external.SourceFileLoader object at 0x1047bcf98>
import 'botocore.vendored.requests.packages.urllib3.util.timeout' # <_frozen_importlib_external.SourceFileLoader object at 0x1047cc2e8>
import 'botocore.vendored.requests.packages.urllib3.util.retry' # <_frozen_importlib_external.SourceFileLoader object at 0x1047cc588>
import 'botocore.vendored.requests.packages.urllib3.util.url' # <_frozen_importlib_external.SourceFileLoader object at 0x1047cca58>
import 'botocore.vendored.requests.packages.urllib3.util' # <_frozen_importlib_external.SourceFileLoader object at 0x1047bc898>
import 'botocore.vendored.requests.packages.urllib3.connection' # <_frozen_importlib_external.SourceFileLoader object at 0x104661f60>
import 'botocore.vendored.requests.packages.urllib3.fields' # <_frozen_importlib_external.SourceFileLoader object at 0x1047e7358>
import 'botocore.vendored.requests.packages.urllib3.filepost' # <_frozen_importlib_external.SourceFileLoader object at 0x1047bc9e8>
import 'botocore.vendored.requests.packages.urllib3.request' # <_frozen_importlib_external.SourceFileLoader object at 0x10467a320>
import 'botocore.vendored.requests.packages.urllib3._collections' # <_frozen_importlib_external.SourceFileLoader object at 0x1047f7b70>
import 'botocore.vendored.requests.packages.urllib3.response' # <_frozen_importlib_external.SourceFileLoader object at 0x1046c61d0>
import 'botocore.vendored.requests.packages.urllib3.connectionpool' # <_frozen_importlib_external.SourceFileLoader object at 0x10464f7f0>
import 'botocore.vendored.requests.packages.urllib3.poolmanager' # <_frozen_importlib_external.SourceFileLoader object at 0x1047f76a0>
import 'botocore.vendored.requests.packages.urllib3' # <_frozen_importlib_external.SourceFileLoader object at 0x10464f390>
import 'botocore.vendored.requests.packages.urllib3.contrib' # <_frozen_importlib_external.SourceFileLoader object at 0x1043e3f28>

Hopefully someone else can make more sense of this stuff!