aws cli cheat sheet

• curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip && unzip awscliv2.zip && sudo ./aws/install★
  AWS CLI v2 (current) — the bundled installer, not pip. pip install awscli installs the old v1, which enters maintenance mode 15 Jul 2026.
• brew install awscli★
  Installs v2 on macOS via Homebrew — keeps updates easy.
• aws --version · aws update
  Confirm the version; aws update (v2.36+) self-updates to the latest.
• aws configure★
  Interactive wizard: sets Access Key, Secret, Region, and output format in ~/.aws/credentials & ~/.aws/config.
• aws configure --profile prod★
  Create a named profile — useful for multiple accounts or roles.
• aws configure list
  Show current active credentials & config source.
• aws configure list-profiles
  List all locally configured profiles.
• aws configure sso★
  Set up IAM Identity Center (SSO) — the modern, keyless auth. Creates an SSO-backed profile.
• aws sso login --profile prod★
  Open the browser to get short-lived SSO credentials for that profile — no long-lived keys on disk.

Credentials precedence: env vars → CLI flags → ~/.aws/credentials → IAM instance role. An instance role is the recommended production approach — no local keys needed.

• aws s3 ls --profile prod★
  Use a non-default named profile for one command.
• aws ec2 describe-instances --region eu-west-1★
  Override the region for one command.
• aws ec2 describe-instances --output table★
  Output as human-readable table (also: json, yaml, text).
• aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,State.Name]'★
  JMESPath query to pluck specific fields from JSON output.
• aws ec2 run-instances ... --dry-run
  Check permissions & validate params without making real changes.
• aws ec2 describe-instances help★
  Append help to any (sub-)command for inline docs.
• aws sts get-caller-identity★
  Show which IAM user / role is currently authenticated.

• aws ec2 describe-instances | jq -r '.Reservations[].Instances[] | .InstanceId'★
  jq -r pipes JSON → extracts just the instance IDs as plain text.
• aws iam list-users | jq -r '.Users[] | .UserId+" "+.UserName'★
  Concatenate fields with + for space-separated output.
• aws dynamodb scan --table-name events --select count | jq .ScannedCount
  Extract a single top-level value.
• ... | jq -r '.Items[] | select(.Status == "ACTIVE") | .Name'
  select() filters array elements by a condition.

Tip: install jq with brew install jq or apt install jq. It turns verbose JSON into scriptable one-liners.

• aws s3 ls★
  List all buckets in the account.
• aws s3 ls s3://mybucket/★
  List objects (files) inside a bucket or prefix.
• aws s3 mb s3://my-new-bucket★
  Make (create) a new bucket — name must be globally unique.
• aws s3 rb s3://my-bucket --force
  Remove bucket and all contents. --force deletes non-empty buckets.
• aws s3api get-bucket-acl --bucket my-bucket
  Check Access Control List — is it public? (low-level s3api command).
• aws s3api put-bucket-acl --acl private --bucket my-bucket
  Make a bucket private (revoke public access).
• aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled
  Enable object versioning — keeps old versions on overwrite/delete.

• aws s3 cp backup.tar s3://my-bucket/★
  Upload a local file to a bucket.
• aws s3 cp s3://my-bucket/backup.tar ./★
  Download an object to the current directory.
• aws s3 cp myfolder/ s3://my-bucket/folder/ --recursive★
  Upload an entire local folder. --recursive walks subdirectories.
• aws s3 mv s3://bucket/old.txt s3://bucket/new.txt
  Move (rename) an object within or between buckets.
• aws s3 rm s3://my-bucket/secret.gz★
  Delete a single object.
• aws s3 rm s3://my-bucket/folder/ --recursive
  Delete all objects under a prefix.
• aws s3 sync ./local-dir/ s3://my-bucket/★
  Sync local → bucket; only uploads new or changed files.
• aws s3 sync s3://src-bucket/ s3://dst-bucket/
  Sync between two buckets (cross-region backup).
• aws s3 sync ./ s3://my-bucket/ --exclude '*.tmp'
  Exclude files matching a glob from the sync operation.
• aws s3 presign s3://bucket/file.pdf --expires-in 3600★
  Generate a temporary signed URL for private objects. Expires in 3600 seconds (1 hour).

s3 vs s3api: s3 = high-level shortcuts (cp, sync, mb). s3api = raw API access for policies, ACLs, versioning.

• aws ec2 describe-instances★
  List all instances (running and stopped) in the region.
• aws ec2 describe-instances --filters Name=instance-state-name,Values=running★
  Show only running instances.
• aws ec2 describe-instances | jq -r '.Reservations[].Instances[] | .InstanceId+" "+.InstanceType+" "+(.Tags[]|select(.Key=="Name").Value)'
  Human-readable table of ID, type, and Name tag via jq.
• aws ec2 run-instances --image-id ami-0abcdef1234 --instance-type t3.micro --security-group-ids sg-xxxx --key-name MyKey★
  Launch (start) a new EC2 instance.
• aws ec2 start-instances --instance-ids i-1234567890abcdef0★
  Start a stopped instance (billing resumes).
• aws ec2 stop-instances --instance-ids i-1234567890abcdef0★
  Stop a running instance (billing pauses for compute).
• aws ec2 terminate-instances --instance-ids i-1234567890abcdef0
  ⚠ Permanently delete an instance and its ephemeral storage.
• aws ec2 describe-instance-status --instance-ids i-xxx
  Check health checks and system status for an instance.
• aws ec2 describe-instances --query 'Reservations[].Instances[].[PublicIpAddress,Tags[?Key==`Name`].Value|[0]]' --output text
  List running instance IPs + Name tags, clean text output.

• aws ec2 describe-security-groups | jq -r '.SecurityGroups[] | .GroupId+" "+.GroupName'★
  List all security groups with ID and name.
• aws ec2 create-security-group --group-name web-sg --description "Web access" --vpc-id vpc-xxx
  Create a new security group inside a VPC.
• aws ec2 authorize-security-group-ingress --group-id sg-xxx --protocol tcp --port 443 --cidr 0.0.0.0/0★
  Open inbound port 443 (HTTPS) from anywhere. Use /0 for all IPs.
• aws ec2 authorize-security-group-ingress --group-id sg-xxx --protocol tcp --port 22 --cidr $MY_IP/32
  Restrict SSH (port 22) to your own IP only — use /32 for one IP.
• aws ec2 revoke-security-group-ingress --group-id sg-xxx --protocol tcp --port 22 --cidr 0.0.0.0/0
  Remove an inbound rule from a security group.
• aws ec2 describe-vpcs | jq -r '.Vpcs[] | .VpcId+" "+.CidrBlock'
  List VPCs and their CIDR blocks.
• aws ec2 describe-subnets --filter Name=vpc-id,Values=vpc-xxx
  List subnets within a specific VPC.

• aws ec2 describe-key-pairs
  List all registered SSH key pairs.
• aws ec2 create-key-pair --key-name MyKey --output text★
  Create a key pair — save the output as a .pem file immediately.
• aws ec2 import-key-pair --key-name MyKey --public-key-material fileb://~/.ssh/id_rsa.pub
  Import your existing local public key so AWS knows it.
• aws ec2 delete-key-pair --key-name MyKey
  Remove a key pair from AWS (doesn't affect local files).
• aws ec2 describe-images --filters Name=is-public,Values=false --query 'Images[].[ImageId,Name]' --output text★
  List your private AMIs (machine images).
• aws ec2 create-image --instance-id i-xxx --name "MyAMI-v1" --no-reboot
  Snapshot a running instance into an AMI without rebooting.
• aws ec2 deregister-image --image-id ami-xxx
  Delete an AMI (doesn't delete the backing EBS snapshots).
• aws ec2 create-tags --resources i-xxx --tags Key=Env,Value=prod
  Add or update tags on any resource — tags are key–value labels.

• aws iam list-users | jq -r '.Users[] | .UserId+" "+.UserName'★
  List all IAM users in the account.
• aws iam get-user
  Show the current caller's IAM user info.
• aws iam create-user --user-name alice★
  Create a new IAM user (no console access or keys yet).
• aws iam delete-user --user-name alice
  Delete a user (must remove keys, policies, group memberships first).
• aws iam list-access-keys --user-name alice★
  List access key IDs for a user (secrets are never shown again after creation).
• aws iam create-access-key --user-name alice | jq -r '.AccessKey | .AccessKeyId+" "+.SecretAccessKey'★
  Generate a new key pair — save the secret immediately, it won't appear again.
• aws iam update-access-key --user-name alice --access-key-id AKIA… --status Inactive
  Deactivate a key without deleting it (useful during key rotation).
• aws iam delete-access-key --user-name alice --access-key-id AKIA…
  Permanently delete an access key.
• aws iam get-account-password-policy
  View the account-level password complexity rules.
• aws iam update-account-password-policy --minimum-password-length 12 --require-symbols --require-numbers
  Enforce a stricter password policy for the whole account.

• aws iam list-groups | jq -r .Groups[].GroupName★
  List all IAM groups — groups collect users and assign shared policies.
• aws iam create-group --group-name Developers
  Create a new group.
• aws iam add-user-to-group --group-name Developers --user-name alice★
  Add a user to a group (they inherit the group's policies).
• aws iam remove-user-from-group --group-name Developers --user-name alice
  Remove a user from a group.
• aws iam list-policies --scope Local | jq -r '.Policies[] | .PolicyName+" "+.Arn'★
  List custom (non-AWS-managed) policies in the account.
• aws iam attach-group-policy --group-name Developers --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess★
  Attach an AWS managed policy to a group.
• aws iam detach-group-policy --group-name Developers --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess
  Remove a policy from a group.
• aws iam list-entities-for-policy --policy-arn arn:aws:iam::…:policy/MyPolicy
  See which users/groups/roles use a given policy.
• aws iam list-roles | jq -r '.Roles[] | .RoleName'
  List IAM roles — roles are assumed by services, instances, or users.

• aws lambda list-functions | jq -r '.Functions[] | .FunctionName+" "+.Runtime+" "+(.MemorySize|tostring)+"MB"'★
  List all Lambda functions with runtime and memory size.
• aws lambda invoke --function-name my-function --payload '{"key":"value"}' output.json★
  Invoke a function synchronously; response goes to output.json.
• aws lambda update-function-code --function-name my-fn --zip-file fileb://fn.zip★
  Deploy new code to an existing function from a local zip.
• aws lambda get-function --function-name DynamoToSQS | jq -r .Code.Location
  Get a pre-signed URL to download the function's source code.
• aws lambda list-layers | jq -r '.Layers[] | .LayerName'
  List Lambda layers (shared libraries/dependencies).
• aws lambda list-event-source-mappings | jq -r '.EventSourceMappings[] | .FunctionArn+" "+.EventSourceArn'
  Show which event sources (SQS, Kinesis, DynamoDB) trigger each function.

• aws rds describe-db-instances | jq -r '.DBInstances[] | .DBInstanceIdentifier+" "+.DBInstanceClass+" "+.Endpoint.Address'★
  List all DB instances with class and endpoint hostname.
• aws rds describe-db-clusters | jq -r '.DBClusters[] | .DBClusterIdentifier+" "+.Endpoint'
  List Aurora clusters (multi-instance databases).
• aws rds create-db-snapshot --db-instance-identifier mydb --db-snapshot-identifier snap-$(date +%F)★
  Take a manual snapshot (backup) of a DB instance.
• aws rds describe-db-snapshots --db-instance-identifier mydb
  List snapshots for a specific DB instance.
• aws rds start-db-instance --db-instance-identifier mydb
  Start a stopped DB instance (billing resumes).
• aws rds stop-db-instance --db-instance-identifier mydb
  Stop a DB instance to pause compute billing.

• aws dynamodb list-tables | jq -r .TableNames[]★
  List all DynamoDB tables.
• aws dynamodb scan --table-name events★
  Return all items from a table (expensive on large tables — use for dev/debug).
• aws dynamodb scan --table-name events --select count | jq .ScannedCount
  Count items without fetching their data.
• aws dynamodb get-item --table-name events --key '{"email":{"S":"bob@example.com"}}'★
  Fetch one item by its primary key. Note the DynamoDB type notation ("S" = String).
• aws dynamodb put-item --table-name events --item '{"email":{"S":"bob@example.com"},"age":{"N":"30"}}'
  Insert or overwrite one item.
• aws dynamodb delete-item --table-name events --key '{"email":{"S":"bob@example.com"}}'
  Delete one item by primary key.
• aws dynamodb query --table-name events --key-condition-expression "email = :e" --expression-attribute-values '{":e":{"S":"bob@example.com"}}'
  Query items by partition key (efficient — uses the index).

• aws ecs list-clusters | jq -r .clusterArns[]★
  List ECS cluster ARNs in the region.
• aws ecs create-cluster --cluster-name my-cluster
  Create a new ECS cluster (container orchestrator).
• aws ecs list-tasks --cluster my-cluster
  List running task ARNs in a cluster.
• aws ecs create-service --cluster my-cluster --service-name web --task-definition web:1 --desired-count 2
  Deploy a service (keeps N task replicas running).
• aws eks list-clusters★
  List Kubernetes (EKS) clusters in the region.
• aws eks create-cluster --name my-k8s --role-arn arn:aws:iam::…:role/EKSRole --resources-vpc-config subnetIds=…,securityGroupIds=…
  Create a managed Kubernetes control plane.
• aws eks update-kubeconfig --name my-k8s★
  Configure kubectl to talk to this EKS cluster.
• aws eks describe-cluster --name my-k8s
  Show cluster details including endpoint and status.

• aws cloudwatch describe-alarms | jq -r '.MetricAlarms[] | .AlarmName+" "+.StateValue'★
  List all alarms and their current state (OK / ALARM / INSUFFICIENT_DATA).
• aws cloudwatch delete-alarms --alarm-names MyAlarm1 MyAlarm2
  Delete one or more alarms (up to 100 at once).
• aws logs describe-log-groups★
  List all CloudWatch log groups.
• aws logs create-log-group --log-group-name /app/prod
  Create a new log group (container for log streams).
• aws logs describe-log-streams --log-group-name /app/prod
  List streams within a log group (one stream per host/container).
• aws logs get-log-events --log-group-name /app/prod --log-stream-name i-xxx★
  Fetch recent log events from a stream.
• aws logs filter-log-events --log-group-name /app/prod --filter-pattern "ERROR"★
  Search for a pattern across all streams in a log group.
• aws logs delete-log-group --log-group-name /app/prod
  Delete a log group and all its streams permanently.

• aws route53 list-hosted-zones | jq -r '.HostedZones[] | .Id+" "+.Name'★
  List all hosted zones (DNS domains) in the account.
• aws route53 create-hosted-zone --name example.com --caller-reference $(date +%s)
  Create a new hosted zone. caller-reference is a unique ID to prevent duplicate creation.
• aws route53 list-resource-record-sets --hosted-zone-id Z1234★
  List all DNS records (A, CNAME, MX, etc.) in a zone.
• aws route53 change-resource-record-sets --hosted-zone-id Z1234 --change-batch file://records.json★
  Create / update / delete records via a JSON change-batch file.
• aws route53 delete-hosted-zone --id Z1234
  Delete a hosted zone (must be empty first).

Change-batch: use Action CREATE, UPSERT (create or update), or DELETE in the JSON file.

• aws cloudfront list-distributions | jq -r '.DistributionList.Items[] | .DomainName+" "+.Origins.Items[0].DomainName'★
  List CloudFront distributions with domain and their origin.
• aws cloudfront create-invalidation --distribution-id EDFDVBD6EXAMPLE --paths "/*"★
  Purge all cached files from edge locations — use after deploying new assets.
• aws elbv2 describe-load-balancers | jq -r '.LoadBalancers[] | .DNSName'★
  List Application/Network Load Balancer DNS names.
• aws elbv2 describe-target-groups | jq -r '.TargetGroups[] | .TargetGroupArn'
  List target groups (the registered EC2 instances/containers behind a load balancer).
• aws elbv2 describe-target-health --target-group-arn arn:aws:… | jq -r '.TargetHealthDescriptions[] | .Target.Id+" "+.TargetHealth.State'
  Check the health status of each registered target.

• aws sns list-topics | jq -r '.Topics[] | .TopicArn'★
  List all SNS topics (notification channels).
• aws sns publish --topic-arn arn:aws:sns:… --message "Deploy complete"★
  Publish a message to an SNS topic — fans out to all subscribers.
• aws sns list-subscriptions | jq -r '.Subscriptions[] | .TopicArn+" "+.Protocol+" "+.Endpoint'
  List what is subscribed to each topic (email, SQS, Lambda, HTTP…).
• aws sqs list-queues | jq -r '.QueueUrls[]'★
  List all SQS queue URLs.
• aws sqs create-queue --queue-name my-queue
  Create a new queue.
• aws sqs send-message --queue-url https://sqs.…/my-queue --message-body "hello"★
  Send a message to a queue.
• aws sqs receive-message --queue-url https://…/my-queue | jq -r '.Messages[] | .Body'★
  Poll and receive a message (dequeues up to 1 by default).
• aws sqs delete-message --queue-url https://… --receipt-handle AQE…
  Acknowledge and remove a message using its receipt handle.
• aws sqs purge-queue --queue-url https://…/my-queue
  Delete all messages from a queue instantly.

• aws cloudtrail describe-trails★
  List all CloudTrail trails (API audit logs).
• aws cloudtrail get-trail-status --name my-trail
  Is logging enabled? When did it last deliver a log file?
• aws cloudtrail create-subscription --name awslog --s3-new-bucket awslog-2026
  Create a trail that logs to a new S3 bucket.
• aws cloudtrail delete-trail --name awslog
  Delete a trail (stops logging — doesn't delete existing logs in S3).
• aws secretsmanager list-secrets | jq -r '.SecretList[] | .Name'★
  List all secrets stored in Secrets Manager.
• aws secretsmanager get-secret-value --secret-id MyDBPassword | jq -r .SecretString★
  Retrieve a secret value — use in scripts instead of hardcoding passwords.
• aws secretsmanager create-secret --name MyDBPassword --secret-string '{"user":"admin","pass":"s3cr3t"}'
  Store a new secret (JSON or plain string).
• aws secretsmanager rotate-secret --secret-id MyDBPassword
  Trigger an immediate secret rotation (requires a rotation Lambda).