Skip to content

Using the AWS CLI

Guide: Installing the AWS CLI on your device

  • Use the official AWS install page at:
  • Verify installtion by running:
aws --version

AWS commands auto-complete (Optional)

  • If using zshrc shell, run the below commands:
echo -e '\nexport PATH=/usr/local/bin/:$PATH\nautoload bashcompinit \
&& bashcompinit\nautoload -Uz compinit && compinit\ncomplete \
-C "/usr/local/bin/aws_completer" aws' >> ~/.zshrc
  • If using Bash shell, run:
echo "complete -C '/usr/local/bin/aws_completer' aws" >> ~/.bashrc && source ~/.bashrc
  • If using Windows: Follow the process below.
# Open your $PROFILE file
Notepad $PROFILE

# If you don't have a $PROFILE, you can create one using;
if (!(Test-Path -Path $PROFILE ))
{ New-Item -Type File -Path $PROFILE -Force }

# Add the below code block to the $PROFILE and save.
Register-ArgumentCompleter -Native -CommandName aws -ScriptBlock {
    param($commandName, $wordToComplete, $cursorPosition)
        $env:COMP_LINE=$wordToComplete
        if ($env:COMP_LINE.Length -lt $cursorPosition){
            $env:COMP_LINE=$env:COMP_LINE + " "
        }
        $env:COMP_POINT=$cursorPosition
        aws_completer.exe | ForEach-Object {
            [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
        }
        Remove-Item Env:\COMP_LINE     
        Remove-Item Env:\COMP_POINT  
}

Authenticating Using an IAM User's credentials for the AWS CLI

Use the below AWS Official documentation for steps in configuring basic setting for an IAM user and retrieving the Access Keys.

Now that you have:

  • The AWS Cli installed and configured
  • Configured an IAM user and retrieved it's Access Keys.
  • Configured the AWS Cli to use the Access Keys.

Next step; Developing your AWS CLI Ninja skills 😄

AWS CLI Ninja skills

(Optional) Install the below tools to enhance your productivity.

  • jq → JSON parsing
  • bat → better output
  • fzf → interactive selection
  • aws-vault → credential management
  • direnv → per-project AWS envs 
    sudo apt search direnv
Sorting... Done
Full Text Search... Done
direnv/noble-updates,noble-security 2.32.1-2ubuntu0.24.04.3 amd64
Utility to set directory specific environment variables

Install using 

sudo apt install jq bat fzf direnv

Core AWS CLI flags you should be familiar with

🔶 --profile

Use in multiple account scenerio. 

aws s3 ls --profile dev
aws ec2 describe-instances --profile prod

Set a default profile for a session: 

export AWS_PROFILE=dev

🔶 --region

Never assume a region. 

aws ec2 describe-instances --region us-east-1

Set it once: 

export AWS_DEFAULT_REGION=us-east-1

🔶 --output

Change output format. 

aws ec2 describe-instances --output table
aws ec2 describe-instances --output yaml

🔶 --query (JMESPath = built-in power)

Extract exactly what you want without jq. 

aws ec2 describe-instances \
  --query 'Reservations[].Instances[].InstanceId'
Filter running instances only: 
aws ec2 describe-instances \
  --query "Reservations[].Instances[?State.Name=='running'].InstanceId"

AWS CLI + jq (Next-Level Power)

🔥 Extract Instance IDs 

aws ec2 describe-instances | jq -r '.Reservations[].Instances[].InstanceId'

🔥 `Get public IPs of running instances 

aws ec2 describe-instances \
| jq -r '.Reservations[].Instances[]
| select(.State.Name=="running")
| .PublicIpAddress'

🔥 List EC2 Name + Instance ID 

aws ec2 describe-instances \
| jq -r '.Reservations[].Instances[]
| [.InstanceId,
   (.Tags[]? | select(.Key=="Name") | .Value)] | @tsv'

AWS CLI "NINJA" Productivity Tricks

🚀 Dry run (simulate before you destroy things) 

aws ec2 terminate-instances --instance-ids <<instance-id>> --dry-run

🚀 Pipe into xargs (bulk actions) 

aws ec2 describe-instances \
  --query "Reservations[].Instances[?State.Name=='running'].InstanceId" \
  --output text \
| xargs aws ec2 stop-instances

🚀 Use --no-paginate

Avoid annoying pagers. 

aws ec2 describe-instances --no-paginate

🚀 Disable the pager permanently 

export AWS_PAGER=""
(Add to .bashrc)

S3 Power Moves

🪣 Sync directories 

aws s3 sync . s3://my-bucket
aws s3 sync s3://my-bucket ./local-dir

🪣 Human-readable bucket sizes 

aws s3 ls s3://terraform-s3-remote-backend-playroom --recursive --human-readable --summarize
2024-11-01 16:14:06  181 Bytes dev/terraform.state

Total Objects: 1
   Total Size: 181 Bytes

🪣 Find large objects 

aws s3 ls s3://my-bucket --recursive \
| sort -k3 -h \
| tail -10

IAM & Security Tricks (Very Important)

🔐 Who am I? 

aws sts get-caller-identity

🔐 List IAM policies attached to a role 

aws iam list-attached-role-policies --role-name MyRole

🔐 Simulate IAM permissions 

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:role/MyRole \
  --action-names s3:PutObject

CloudWatch & Logs Like a Pro

🔎 Tail logs in real-time 

aws logs tail /aws/lambda/my-function --follow

🔎 Search logs

aws logs filter-log-events \
  --log-group-name /aws/lambda/my-function \
  --filter-pattern "ERROR"

EC2 Metadata (From Inside an Instance)

curl http://169.254.169.254/latest/meta-data/

Instance ID:

curl http://169.254.169.254/latest/meta-data/instance-id

AWS CLI Aliases (Huge Time Saver)

Add to ~/.bashrc:

alias awsls='aws s3 ls'
alias awswhoami='aws sts get-caller-identity'
alias ec2running='aws ec2 describe-instances --query "Reservations[].Instances[?State.Name==\`running\`].InstanceId" --output text'

Reload:

source ~/.bashrc

Use aws configure sso (Modern Auth)

aws configure sso

Then:

aws s3 ls --profile my-sso-profile

Debugging AWS CLI Issues

🛠 Enable debug mode

aws ec2 describe-instances --debug
🛠 Check config

aws configure list
      Name                    Value             Type    Location
      ----                    -----             ----    --------
   profile                <not set>             None    None
access_key     ****************M7PW shared-credentials-file
secret_key     ****************nC5J shared-credentials-file
    region                us-east-1      config-file    ~/.aws/config

Automation & Scripting Patterns

Bash loop 

for r in us-east-1 us-west-2 eu-west-1; do
  aws ec2 describe-instances --region $r --query 'Reservations[].Instances[].InstanceId'
done

AWS CLI Mental Model (Important)

Think in pipes:

aws → filter → transform → act

Example:

aws ec2 describe-instances \
| jq ... \
| xargs aws ec2 stop-instances