AWS CLI Kung Fu¶

Guide: Installing the AWS CLI on your device¶

Use the official AWS install page at:

Verify installtion by running:

aws --version

AWS commands auto-complete (Optional)¶

If using zshrc shell, run the below commands:

echo -e '\nexport PATH=/usr/local/bin/:$PATH\nautoload bashcompinit \
&& bashcompinit\nautoload -Uz compinit && compinit\ncomplete \
-C "/usr/local/bin/aws_completer" aws' >> ~/.zshrc

If using Bash shell, run:

echo "complete -C '/usr/local/bin/aws_completer' aws" >> ~/.bashrc && source ~/.bashrc

If using Windows: Follow the process below.

# Open your $PROFILE file
Notepad $PROFILE

# If you don't have a $PROFILE, you can create one using;
if (!(Test-Path -Path $PROFILE ))
{ New-Item -Type File -Path $PROFILE -Force }

# Add the below code block to the $PROFILE and save.
Register-ArgumentCompleter -Native -CommandName aws -ScriptBlock {
    param($commandName, $wordToComplete, $cursorPosition)
        $env:COMP_LINE=$wordToComplete
        if ($env:COMP_LINE.Length -lt $cursorPosition){
            $env:COMP_LINE=$env:COMP_LINE + " "
        }
        $env:COMP_POINT=$cursorPosition
        aws_completer.exe | ForEach-Object {
            [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
        }
        Remove-Item Env:\COMP_LINE     
        Remove-Item Env:\COMP_POINT  
}

Authenticating Using an IAM User's credentials for the AWS CLI¶

Use the below AWS Official documentation for steps in configuring basic setting for an IAM user and retrieving the Access Keys.

Now that you have:

The AWS Cli installed and configured
Configured an IAM user and retrieved it's Access Keys.
Configured the AWS Cli to use the Access Keys.

Next step; Developing your AWS CLI Ninja skills

AWS CLI Ninja skills¶

(Optional) Install the below tools to enhance your productivity.

jq → JSON parsing
bat → better output
fzf → interactive selection
aws-vault → credential management

direnv → per-project AWS envs

sudo apt search direnv
Sorting... Done
Full Text Search... Done
direnv/noble-updates,noble-security 2.32.1-2ubuntu0.24.04.3 amd64
Utility to set directory specific environment variables

Install using

sudo apt install jq bat fzf direnv

Core AWS CLI flags you should be familiar with¶

--profile

Use in multiple account scenerio.

aws s3 ls --profile dev
aws ec2 describe-instances --profile prod

Set a default profile for a session:

export AWS_PROFILE=dev

--region

Never assume a region.

aws ec2 describe-instances --region us-east-1

Set it once:

export AWS_DEFAULT_REGION=us-east-1

--output

Change output format.

aws ec2 describe-instances --output table
aws ec2 describe-instances --output yaml

--query (JMESPath = built-in power)

Extract exactly what you want without jq.

aws ec2 describe-instances \
  --query 'Reservations[].Instances[].InstanceId'

Filter running instances only:

aws ec2 describe-instances \
  --query "Reservations[].Instances[?State.Name=='running'].InstanceId"

AWS CLI + jq (Next-Level Power)¶

Extract Instance IDs

aws ec2 describe-instances | jq -r '.Reservations[].Instances[].InstanceId'

`Get public IPs of running instances

aws ec2 describe-instances \
| jq -r '.Reservations[].Instances[]
| select(.State.Name=="running")
| .PublicIpAddress'

List EC2 Name + Instance ID

aws ec2 describe-instances \
| jq -r '.Reservations[].Instances[]
| [.InstanceId,
   (.Tags[]? | select(.Key=="Name") | .Value)] | @tsv'

AWS CLI "NINJA" Productivity Tricks¶

Dry run (simulate before you destroy things)

aws ec2 terminate-instances --instance-ids <<instance-id>> --dry-run

Pipe into xargs (bulk actions)

aws ec2 describe-instances \
  --query "Reservations[].Instances[?State.Name=='running'].InstanceId" \
  --output text \
| xargs aws ec2 stop-instances

Use --no-paginate

Avoid annoying pagers.

aws ec2 describe-instances --no-paginate

Disable the pager permanently

export AWS_PAGER=""

(Add to .bashrc)

S3 Power Moves¶

Sync directories

aws s3 sync . s3://my-bucket
aws s3 sync s3://my-bucket ./local-dir

Human-readable bucket sizes

aws s3 ls s3://terraform-s3-remote-backend-playroom --recursive --human-readable --summarize
2024-11-01 16:14:06  181 Bytes dev/terraform.state

Total Objects: 1
   Total Size: 181 Bytes

Find large objects

aws s3 ls s3://my-bucket --recursive \
| sort -k3 -h \
| tail -10

IAM & Security Tricks (Very Important)¶

Who am I?

aws sts get-caller-identity

List IAM policies attached to a role

aws iam list-attached-role-policies --role-name MyRole

Simulate IAM permissions

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:role/MyRole \
  --action-names s3:PutObject

`CloudWatch & Logs Like a Pro`¶

Tail logs in real-time

aws logs tail /aws/lambda/my-function --follow

Search logs

aws logs filter-log-events \
  --log-group-name /aws/lambda/my-function \
  --filter-pattern "ERROR"

`EC2 Metadata (From Inside an Instance)`¶

curl http://169.254.169.254/latest/meta-data/

Instance ID:

curl http://169.254.169.254/latest/meta-data/instance-id

`AWS CLI Aliases (Huge Time Saver)`¶

Add to ~/.bashrc:

alias awsls='aws s3 ls'
alias awswhoami='aws sts get-caller-identity'
alias ec2running='aws ec2 describe-instances --query "Reservations[].Instances[?State.Name==\`running\`].InstanceId" --output text'

Reload:

source ~/.bashrc

`Use aws configure sso (Modern Auth)`¶

aws configure sso

Then:

aws s3 ls --profile my-sso-profile

`Debugging AWS CLI Issues`¶

Enable debug mode

aws ec2 describe-instances --debug

Check config

aws configure list
      Name                    Value             Type    Location
      ----                    -----             ----    --------
   profile                <not set>             None    None
access_key     ****************M7PW shared-credentials-file
secret_key     ****************nC5J shared-credentials-file
    region                us-east-1      config-file    ~/.aws/config

`Automation & Scripting Patterns`¶

Bash loop

for r in us-east-1 us-west-2 eu-west-1; do
  aws ec2 describe-instances --region $r --query 'Reservations[].Instances[].InstanceId'
done

`AWS CLI Mental Model (Important)`¶

Think in pipes:

aws → filter → transform → act

Example:

aws ec2 describe-instances \
| jq ... \
| xargs aws ec2 stop-instances