diff --git a/cmd/litestream/main.go b/cmd/litestream/main.go
index 0c02c52..5e6c3ec 100644
--- a/cmd/litestream/main.go
+++ b/cmd/litestream/main.go
@@ -149,10 +149,10 @@ type Config struct {
 func (c *Config) propagateGlobalSettings() {
 	for _, dbc := range c.DBs {
 		for _, rc := range dbc.Replicas {
-			if rc.AccessKeyID != "" {
+			if rc.AccessKeyID == "" {
 				rc.AccessKeyID = c.AccessKeyID
 			}
-			if rc.SecretAccessKey != "" {
+			if rc.SecretAccessKey == "" {
 				rc.SecretAccessKey = c.SecretAccessKey
 			}
 		}
diff --git a/cmd/litestream/main_test.go b/cmd/litestream/main_test.go
index b34b8f1..a1c89f0 100644
--- a/cmd/litestream/main_test.go
+++ b/cmd/litestream/main_test.go
@@ -1,6 +1,8 @@
 package main_test
 
 import (
+	"io/ioutil"
+	"path/filepath"
 	"testing"
 
 	"github.com/benbjohnson/litestream"
@@ -8,6 +10,37 @@ import (
 	"github.com/benbjohnson/litestream/s3"
 )
 
+func TestReadConfigFile(t *testing.T) {
+	// Ensure global AWS settings are propagated down to replica configurations.
+	t.Run("PropagateGlobalSettings", func(t *testing.T) {
+		filename := filepath.Join(t.TempDir(), "litestream.yml")
+		if err := ioutil.WriteFile(filename, []byte(`
+access-key-id: XXX
+secret-access-key: YYY
+
+dbs:
+  - path: /path/to/db
+    replicas:
+      - url: s3://foo/bar
+`[1:]), 0666); err != nil {
+			t.Fatal(err)
+		}
+
+		config, err := main.ReadConfigFile(filename)
+		if err != nil {
+			t.Fatal(err)
+		} else if got, want := config.AccessKeyID, `XXX`; got != want {
+			t.Fatalf("AccessKeyID=%v, want %v", got, want)
+		} else if got, want := config.SecretAccessKey, `YYY`; got != want {
+			t.Fatalf("SecretAccessKey=%v, want %v", got, want)
+		} else if got, want := config.DBs[0].Replicas[0].AccessKeyID, `XXX`; got != want {
+			t.Fatalf("Replica.AccessKeyID=%v, want %v", got, want)
+		} else if got, want := config.DBs[0].Replicas[0].SecretAccessKey, `YYY`; got != want {
+			t.Fatalf("Replica.SecretAccessKey=%v, want %v", got, want)
+		}
+	})
+}
+
 func TestNewFileReplicaFromConfig(t *testing.T) {
 	r, err := main.NewReplicaFromConfig(&main.ReplicaConfig{Path: "/foo"}, nil)
 	if err != nil {