Logstash and cloud.auth not working correctly

I spent a whole day trying to figure out why my logstash (running on ec2) could not connect into Elastic Cloud endpoint. Added cloud.id and cloud.auth in my logstash.yml, but every time I was getting 401 response.
After hours and hours of reading documentation and forum I decided to add user => "elastic"
password => "password" in output on logstash.conf and finnaly it worked!

Can someone explain why it is not enough to add cloud.auth and cloud.id ?
When I already have specified my password in settings file, why do I again need to specify it in every config file?

logstash.yml controls logstash process execution and behavior. output is part of pipeline config, so it needs to be defined in a pipeline configuration file.