Skip to content
beginner Phase 1 · AWS Fundamentals

AWS CLI & SDK

Use AWS CLI and SDK to manage resources programmatically.

1h
0 problems
Topic Progress 0%

AWS CLI Installation and Configuration

AWS CLI Installation and Configuration

Installation Methods

# Linux (x86_64)
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Linux (ARM64)
curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# macOS
brew install awscli

# Windows
msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi

# Verify installation
aws --version
# aws-cli/2.15.0 Python/3.11.6 Linux/5.15.0

Configuration

# Configure default profile
aws configure
# AWS Access Key ID: AKIAIOSFODNN7EXAMPLE
# AWS Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# Default region name: us-east-1
# Default output format: json

# Configure named profile
aws configure --profile prod

# List all profiles
aws configure list-profiles

# View current configuration
aws configure list

# Configuration files location
# ~/.aws/config - profiles and settings
# ~/.aws/credentials - access keys

Environment Variables

# Override configuration with environment variables
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_DEFAULT_REGION=us-east-1
export AWS_DEFAULT_OUTPUT=json

# Use specific profile
export AWS_PROFILE=prod

Essential CLI Commands

Essential CLI Commands

EC2 Commands

# List all instances
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].[InstanceId,State.Name,InstanceType,PublicIpAddress]' \
  --output table

# Filter instances by tag
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=Production"

# Start/stop instances
aws ec2 start-instances --instance-ids i-1234567890abcdef0
aws ec2 stop-instances --instance-ids i-1234567890abcdef0

# Launch an instance
aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t3.micro \
  --key-name my-key

# Create a security group
aws ec2 create-security-group \
  --group-name my-sg \
  --description "My security group" \
  --vpc-id vpc-12345678

S3 Commands

# List buckets
aws s3 ls

# List objects in a bucket
aws s3 ls s3://my-bucket

# Sync directory to S3
aws s3 sync ./local-dir s3://my-bucket/remote-dir

# Copy files
aws s3 cp file.txt s3://my-bucket/path/file.txt
aws s3 cp s3://my-bucket/file.txt ./local-file.txt

# Remove files
aws s3 rm s3://my-bucket/old-file.txt

# Remove all objects in a bucket
aws s3 rm s3://my-bucket --recursive

IAM Commands

# List users
aws iam list-users

# Create a user
aws iam create-user --user-name new-developer

# Get user details
aws iam get-user --user-name new-developer

# List policies
aws iam list-policies --scope Local

# Attach a policy
aws iam attach-user-policy \
  --user-name new-developer \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

CLI Output Formatting and Filtering

CLI Output Formatting and Filtering

Output Formats

# JSON output (default)
aws ec2 describe-instances --output json

# Table output
aws ec2 describe-instances --output table

# Text output
aws ec2 describe-instances --output text

# YAML output
aws ec2 describe-instances --output yaml

JMESPath Queries

# Get only instance IDs
aws ec2 describe-instances --query 'Reservations[*].Instances[*].InstanceId' --output text

# Get specific fields
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name]' --output table

# Filter with JMESPath
aws ec2 describe-instances --query 'Reservations[*].Instances[?State.Name==`running`].[InstanceId,PublicIpAddress]' --output table

# Get first item
aws ec2 describe-instances --query 'Reservations[0].Instances[0]'

# Sort by creation date
aws ec2 describe-instances --query 'sort_by(Reservations[*].Instances[*],&LaunchTime)[-5:]' --output table

Pagination

# The CLI handles pagination automatically
aws iam list-policies --output table  # Shows up to 100

# For services that don't paginate automatically
aws ec2 describe-instances --max-results 10 --next-token token-value

# Use --page-size to control API call batching
aws s3api list-objects-v2 --bucket my-bucket --page-size 100

Combining Filters

# Multiple filters
aws ec2 describe-instances \
  --filters \
    "Name=instance-type,Values=t3.micro,t3.small" \
    "Name=instance-state-name,Values=running" \
    "Name=tag:Environment,Values=Production"

# Using tag filters
aws ec2 describe-instances \
  --filters "Name=tag:Project,Values=MyApp" \
  --query 'Reservations[*].Instances[*].[InstanceId,Tags[?Key==`Name`].Value|[0]]' \
  --output table

CLI Automation and Scripting

CLI Automation and Scripting

Shell Script Examples

#!/bin/bash
# backup-s3.sh - Automated S3 backup script

SOURCE_BUCKET="my-app-production"
BACKUP_BUCKET="my-app-backups"
DATE=$(date +%Y-%m-%d)
LOG_FILE="/var/log/s3-backup.log"

# Function to log messages
log() {
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# Enable versioning on backup bucket
aws s3api put-bucket-versioning \
  --bucket "$BACKUP_BUCKET" \
  --versioning-configuration Status=Enabled 2>> "$LOG_FILE"

# Copy all objects with today's date
aws s3 sync \
  "s3://$SOURCE_BUCKET" \
  "s3://$BACKUP_BUCKET/$DATE/" \
  --storage-class STANDARD_IA \
  --only-show-errors

if [ $? -eq 0 ]; then
  log "SUCCESS: Backup completed for $DATE"
else
  log "ERROR: Backup failed for $DATE"
  exit 1
fi

# Clean up backups older than 30 days
CUTOFF_DATE=$(date -d "30 days ago" +%Y-%m-%d)
log "Cleaning up backups older than $CUTOFF_DATE"

EC2 Instance Lifecycle Script

#!/bin/bash
# ec2-lifecycle.sh

ACTION=$1
INSTANCE_IDS=$2

function start_instances() {
  aws ec2 start-instances --instance-ids $INSTANCE_IDS
  aws ec2 wait instance-running --instance-ids $INSTANCE_IDS
  echo "Instances are running"
}

function stop_instances() {
  aws ec2 stop-instances --instance-ids $INSTANCE_IDS
  aws ec2 wait instance-stopped --instance-ids $INSTANCE_IDS
  echo "Instances are stopped"
}

case $ACTION in
  start) start_instances ;;
  stop) stop_instances ;;
  *) echo "Usage: $0 {start|stop} instance-id1 instance-id2" ;;
esac

AWS CLI with Named Profiles

# Use specific profile
aws --profile production s3 ls

# Cross-account access
aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/CrossAccountRole \
  --role-session-name CrossAccountSession

# Use temporary credentials
export AWS_ACCESS_KEY_ID=$(jq -r '.Credentials.AccessKeyId' <<< $ASSUME_ROLE_OUTPUT)
export AWS_SECRET_ACCESS_KEY=$(jq -r '.Credentials.SecretAccessKey' <<< $ASSUME_ROLE_OUTPUT)
export AWS_SESSION_TOKEN=$(jq -r '.Credentials.SessionToken' <<< $ASSUME_ROLE_OUTPUT)

CLI Best Practices and Advanced Features

CLI Best Practices and Advanced Features

Security Best Practices

# Use IAM roles instead of access keys when possible
# Use --no-sign-request for public resources
aws s3 ls s3://my-public-bucket --no-sign-request

# Use --endpoint-url for custom endpoints (LocalStack, MinIO)
aws s3 ls --endpoint-url http://localhost:4566

# Enable CloudTrail to log all API calls
aws cloudtrail create-trail --name my-trail --s3-bucket-name my-log-bucket
aws cloudtrail start-logging --name my-trail

CLI Tips

# Get help on any command
aws ec2 help
aws ec2 describe-instances help

# Get service endpoint info
aws ec2 describe-endpoints --output table

# Check service health
aws health describe-events

# Get pricing info (via pricing API)
aws pricing get-products \
  --service-code EC2 \
  --filters Name=instanceType,Values=t3.micro

# Use --dry-run to preview changes
aws ec2 run-instances --image-id ami-xxx --instance-type t3.micro --dry-run

Advanced Filtering

# Combine multiple query operations
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name,Tags[?Key==`Name`].Value|[0]]' \
  --output text | column -t

# Use pipe to filter output
aws ec2 describe-instances --output text | grep running

# Export to CSV
aws iam list-users --query 'Users[*].[UserName,CreateDate,PasswordLastUsed]' --output text | \
  awk 'BEGIN{print "User,Created,LastUsed"} {print $1","$2","$3}' > users.csv

CLI Aliases

# Create aliases in ~/.aws/config
[alias]
ls-instances = ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,InstanceType]' --output table
ls-buckets = s3 ls
stop-all = ec2 stop-instances --instance-ids $(aws ec2 describe-instances --query 'Reservations[*].Instances[*].InstanceId' --output text)

# Use aliases
aws ls-instances