Cloud Console and CLI

You just got access to an AWS account. You log in and see a dashboard with hundreds of services, menus, and options. Where do you start? The AWS Management Console is the web-based interface for managing AWS resources. It is the first tool you will use and the one you will return to frequently.

The console home page shows your recent services, favorites, and a search bar. The search bar is your most powerful navigation tool. Type EC2 and it shows the EC2 service, related documentation, and tutorials. The top navigation bar provides access to the region selector (choose which region your resources deploy to), account settings (billing, security credentials), and support.

Each AWS service has its own console page. The EC2 console shows running instances, security groups, key pairs, and AMIs. The S3 console lists your buckets and objects. The IAM console manages users, roles, and policies. Every service console follows a consistent pattern: a left-hand navigation panel for sub-resources, a main content area showing your resources, and action buttons for creating, modifying, or deleting resources.

Key navigation concepts include the Resource Explorer, which lets you search across all services for resources by name, tag, or type. Tags are key-value pairs you attach to resources for organization and cost allocation. Tag your resources consistently from day one; it saves enormous time when managing hundreds of resources across multiple projects.

The Cost Explorer in the billing dashboard shows your spending patterns over time. You can break down costs by service, region, tag, or account. This is essential for identifying waste and optimizing your cloud spend. Set up billing alerts through Amazon CloudWatch to get notified when spending exceeds thresholds you define.

Security in the console centers on IAM (Identity and Access Management). The IAM console manages who can access what. You create users for individuals, groups for teams, and roles for services. Policies define permissions in JSON format. Never use the root account for daily operations; create an IAM admin user with MFA enabled and use that for all console access.

The console is great for exploration and one-off tasks, but production work demands automation. The AWS Command Line Interface (CLI) is a unified tool that gives you command-line access to AWS services. If you can click it in the console, you can script it with the CLI.

Installation varies by platform. On Windows, download the MSI installer from AWS or use winget install Amazon.AWSCLI. On macOS, use brew install awscli. On Linux, use your package manager (apt, yum, dnf) or install from the bundled installer. After installation, verify with aws --version. AWS CLI v2 is the current major version; v1 is legacy.

Configuration requires three credentials: your Access Key ID, Secret Access Key, and default region. Run aws configure to set these up interactively. The credentials are stored in ~/.aws/credentials and the config in ~/.aws/config. For security best practices, never commit these files to version control.

You can create access keys in the IAM console under Security Credentials. Each user can have two active access keys at a time. Rotate keys regularly and delete unused ones. For enhanced security, use IAM roles instead of long-lived access keys whenever possible. If you are running CLI commands from an EC2 instance, the instance can assume an IAM role, eliminating the need for stored credentials.

Profiles let you manage multiple AWS accounts or regions from a single machine. Create named profiles with aws configure --profile production and aws configure --profile staging. Then use --profile flag with any command to target a specific account. This is essential for engineers managing dev, staging, and production environments.

The AWS CLI follows a consistent syntax: aws [service] [command] [options]. Here are the essential commands for the three foundational services.

EC2 Commands manage your virtual servers. aws ec2 describe-instances lists all instances with their state, IP addresses, and tags. aws ec2 run-instances launches a new instance with specified AMI, instance type, and key pair. aws ec2 stop-instances and aws ec2 start-instances control instance lifecycle. aws ec2 terminate-instances permanently deletes an instance. aws ec2 create-security-group and aws ec2 authorize-security-group-ingress manage network firewall rules. Always filter by region with --region flag if not configured as default.

S3 Commands manage object storage. aws s3 ls lists buckets. aws s3 mb s3://my-bucket-name creates a bucket. aws s3 cp file.txt s3://my-bucket/ uploads a file. aws s3 sync ./local-folder s3://my-bucket/ synchronizes a local directory with a bucket (only uploads changed files). aws s3 rm s3://my-bucket/file.txt deletes an object. aws s3api put-bucket-policy sets access policies. S3 is the workhorse of AWS storage; mastering these commands is essential.

IAM Commands manage access. aws iam list-users shows all users. aws iam create-user --user-name alice creates a new user. aws iam create-access-key --user-name alice generates credentials for a user. aws iam put-user-policy attaches an inline policy. aws iam create-group and aws iam add-user-to-group manage team access. aws iam list-roles shows service roles. Always follow the principle of least privilege; grant only the permissions needed for the specific task.

The CLI supports output formatting with --output table, --output json, and --output text flags. Use --query parameter with JMESPath expressions to filter results. For example, aws ec2 describe-instances --query Reservations[].Instances[].[InstanceId,State.Name,PublicIpAddress] --output table shows a clean table of instance IDs, states, and public IPs.

The console and CLI solve different problems. Knowing when to use each is a practical skill that improves your efficiency.

Use the console when you are exploring unfamiliar services, visually debugging resource configurations, or performing one-off administrative tasks. The console excels at discovery; you can browse service options, see visual dashboards, and understand resource relationships at a glance. The billing dashboard, CloudWatch metrics graphs, and VPC network diagrams are all console-native experiences that have no CLI equivalent. The console is also better for tasks that benefit from visual feedback, such as building IAM policies with the visual editor or configuring Auto Scaling groups with the scaling policy wizard.

Use the CLI when you are automating repetitive tasks, scripting infrastructure provisioning, integrating with CI/CD pipelines, or debugging in environments without browser access (like SSH sessions on remote servers). The CLI is deterministic; the same command produces the same result every time. This makes it ideal for automation and reproducibility. You can chain CLI commands in shell scripts, pipe output to other tools, and version control your infrastructure commands.

Infrastructure as Code (IaC) goes beyond the CLI. Tools like AWS CloudFormation, Terraform, and AWS CDK define your infrastructure in code files. IaC is declarative: you describe the desired end state, and the tool figures out how to create it. This is the professional standard for cloud management. The CLI is imperative; you specify each action step by step. IaC is declarative; you specify what you want, and the tool makes it happen.

The practical workflow for most cloud engineers combines both. Use the console for initial exploration and visual verification. Use the CLI for quick commands and scripting. Use IaC for production infrastructure management. A typical day might involve checking costs in the console, running a CLI command to restart a stuck instance, and editing a Terraform file to add a new service. Master all three; each has its place.