aws cli cheat sheet

• pip install awscli★
  Install AWS CLI v1 via pip (Python package manager).
• brew install awscli★
  Install on macOS via Homebrew — keeps updates easy.
• aws --version
  Confirm the installed version.
• aws configure★
  Interactive wizard: sets Access Key, Secret, Region, and output format in ~/.aws/credentials & ~/.aws/config.
• aws configure --profile prod★
  Create a named profile — useful for multiple accounts or roles.
• aws configure list
  Show current active credentials & config source.
• aws configure list-profiles
  List all locally configured profiles.

Credentials precedence: env vars → CLI flags → ~/.aws/credentials → IAM instance role. An instance role is the recommended production approach — no local keys needed.

• aws s3 ls --profile prod★
  Use a non-default named profile for one command.
• aws ec2 describe-instances --region eu-west-1★
  Override the region for one command.
• aws ec2 describe-instances --output table★
  Output as human-readable table (also: json, yaml, text).
• aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,State.Name]'★
  JMESPath query to pluck specific fields from JSON output.
• aws ec2 run-instances ... --dry-run
  Check permissions & validate params without making real changes.
• aws ec2 describe-instances help★
  Append help to any (sub-)command for inline docs.
• aws sts get-caller-identity★
  Show which IAM user / role is currently authenticated.

• aws ec2 describe-instances | jq -r '.Reservations[].Instances[] | .InstanceId'★
  jq -r pipes JSON → extracts just the instance IDs as plain text.
• aws iam list-users | jq -r '.Users[] | .UserId+" "+.UserName'★
  Concatenate fields with + for space-separated output.
• aws dynamodb scan --table-name events --select count | jq .ScannedCount
  Extract a single top-level value.
• ... | jq -r '.Items[] | select(.Status == "ACTIVE") | .Name'
  select() filters array elements by a condition.

Tip: install jq with brew install jq or apt install jq. It turns verbose JSON into scriptable one-liners.

• aws s3 ls★
  List all buckets in the account.
• aws s3 ls s3://mybucket/★
  List objects (files) inside a bucket or prefix.
• aws s3 mb s3://my-new-bucket★
  Make (create) a new bucket — name must be globally unique.
• aws s3 rb s3://my-bucket --force
  Remove bucket and all contents. --force deletes non-empty buckets.
• aws s3api get-bucket-acl --bucket my-bucket
  Check Access Control List — is it public? (low-level s3api command).
• aws s3api put-bucket-acl --acl private --bucket my-bucket
  Make a bucket private (revoke public access).
• aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled
  Enable object versioning — keeps old versions on overwrite/delete.

• aws s3 cp backup.tar s3://my-bucket/★
  Upload a local file to a bucket.
• aws s3 cp s3://my-bucket/backup.tar ./★
  Download an object to the current directory.
• aws s3 cp myfolder/ s3://my-bucket/folder/ --recursive★
  Upload an entire local folder. --recursive walks subdirectories.
• aws s3 mv s3://bucket/old.txt s3://bucket/new.txt
  Move (rename) an object within or between buckets.
• aws s3 rm s3://my-bucket/secret.gz★
  Delete a single object.
• aws s3 rm s3://my-bucket/folder/ --recursive
  Delete all objects under a prefix.
• aws s3 sync ./local-dir/ s3://my-bucket/★
  Sync local → bucket; only uploads new or changed files.
• aws s3 sync s3://src-bucket/ s3://dst-bucket/
  Sync between two buckets (cross-region backup).
• aws s3 sync ./ s3://my-bucket/ --exclude '*.tmp'
  Exclude files matching a glob from the sync operation.
• aws s3 presign s3://bucket/file.pdf --expires-in 3600★
  Generate a temporary signed URL for private objects. Expires in 3600 seconds (1 hour).

s3 vs s3api: s3 = high-level shortcuts (cp, sync, mb). s3api = raw API access for policies, ACLs, versioning.

• aws ec2 describe-instances★
  List all instances (running and stopped) in the region.
• aws ec2 describe-instances --filters Name=instance-state-name,Values=running★
  Show only running instances.
• aws ec2 describe-instances | jq -r '.Reservations[].Instances[] | .InstanceId+" "+.InstanceType+" "+(.Tags[]|select(.Key=="Name").Value)'
  Human-readable table of ID, type, and Name tag via jq.
• aws ec2 run-instances --image-id ami-0abcdef1234 --instance-type t3.micro --security-group-ids sg-xxxx --key-name MyKey★
  Launch (start) a new EC2 instance.
• aws ec2 start-instances --instance-ids i-1234567890abcdef0★
  Start a stopped instance (billing resumes).
• aws ec2 stop-instances --instance-ids i-1234567890abcdef0★
  Stop a running instance (billing pauses for compute).
• aws ec2 terminate-instances --instance-ids i-1234567890abcdef0
  ⚠ Permanently delete an instance and its ephemeral storage.
• aws ec2 describe-instance-status --instance-ids i-xxx
  Check health checks and system status for an instance.
• aws ec2 describe-instances --query 'Reservations[].Instances[].[PublicIpAddress,Tags[?Key==`Name`].Value|[0]]' --output text
  List running instance IPs + Name tags, clean text output.

• aws ec2 describe-security-groups | jq -r '.SecurityGroups[] | .GroupId+" "+.GroupName'★
  List all security groups with ID and name.
• aws ec2 create-security-group --group-name web-sg --description "Web access" --vpc-id vpc-xxx
  Create a new security group inside a VPC.
• aws ec2 authorize-security-group-ingress --group-id sg-xxx --protocol tcp --port 443 --cidr 0.0.0.0/0★
  Open inbound port 443 (HTTPS) from anywhere. Use /0 for all IPs.
• aws ec2 authorize-security-group-ingress --group-id sg-xxx --protocol tcp --port 22 --cidr $MY_IP/32
  Restrict SSH (port 22) to your own IP only — use /32 for one IP.
• aws ec2 revoke-security-group-ingress --group-id sg-xxx --protocol tcp --port 22 --cidr 0.0.0.0/0
  Remove an inbound rule from a security group.
• aws ec2 describe-vpcs | jq -r '.Vpcs[] | .VpcId+" "+.CidrBlock'
  List VPCs and their CIDR blocks.
• aws ec2 describe-subnets --filter Name=vpc-id,Values=vpc-xxx
  List subnets within a specific VPC.

• aws ec2 describe-key-pairs
  List all registered SSH key pairs.
• aws ec2 create-key-pair --key-name MyKey --output text★
  Create a key pair — save the output as a .pem file immediately.
• aws ec2 import-key-pair --key-name MyKey --public-key-material fileb://~/.ssh/id_rsa.pub
  Import your existing local public key so AWS knows it.
• aws ec2 delete-key-pair --key-name MyKey
  Remove a key pair from AWS (doesn't affect local files).
• aws ec2 describe-images --filters Name=is-public,Values=false --query 'Images[].[ImageId,Name]' --output text★
  List your private AMIs (machine images).
• aws ec2 create-image --instance-id i-xxx --name "MyAMI-v1" --no-reboot
  Snapshot a running instance into an AMI without rebooting.
• aws ec2 deregister-image --image-id ami-xxx
  Delete an AMI (doesn't delete the backing EBS snapshots).
• aws ec2 create-tags --resources i-xxx --tags Key=Env,Value=prod
  Add or update tags on any resource — tags are key–value labels.

• aws iam list-users | jq -r '.Users[] | .UserId+" "+.UserName'★
  List all IAM users in the account.
• aws iam get-user
  Show the current caller's IAM user info.
• aws iam create-user --user-name alice★
  Create a new IAM user (no console access or keys yet).
• aws iam delete-user --user-name alice
  Delete a user (must remove keys, policies, group memberships first).
• aws iam list-access-keys --user-name alice★
  List access key IDs for a user (secrets are never shown again after creation).
• aws iam create-access-key --user-name alice | jq -r '.AccessKey | .AccessKeyId+" "+.SecretAccessKey'★
  Generate a new key pair — save the secret immediately, it won't appear again.
• aws iam update-access-key --user-name alice --access-key-id AKIA… --status Inactive
  Deactivate a key without deleting it (useful during key rotation).
• aws iam delete-access-key --user-name alice --access-key-id AKIA…
  Permanently delete an access key.
• aws iam get-account-password-policy
  View the account-level password complexity rules.
• aws iam update-account-password-policy --minimum-password-length 12 --require-symbols --require-numbers
  Enforce a stricter password policy for the whole account.

• aws iam list-groups | jq -r .Groups[].GroupName★
  List all IAM groups — groups collect users and assign shared policies.
• aws iam create-group --group-name Developers
  Create a new group.
• aws iam add-user-to-group --group-name Developers --user-name alice★
  Add a user to a group (they inherit the group's policies).
• aws iam remove-user-from-group --group-name Developers --user-name alice
  Remove a user from a group.
• aws iam list-policies --scope Local | jq -r '.Policies[] | .PolicyName+" "+.Arn'★
  List custom (non-AWS-managed) policies in the account.
• aws iam attach-group-policy --group-name Developers --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess★
  Attach an AWS managed policy to a group.
• aws iam detach-group-policy --group-name Developers --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess
  Remove a policy from a group.
• aws iam list-entities-for-policy --policy-arn arn:aws:iam::…:policy/MyPolicy
  See which users/groups/roles use a given policy.
• aws iam list-roles | jq -r '.Roles[] | .RoleName'
  List IAM roles — roles are assumed by services, instances, or users.

• aws lambda list-functions | jq -r '.Functions[] | .FunctionName+" "+.Runtime+" "+(.MemorySize|tostring)+"MB"'★
  List all Lambda functions with runtime and memory size.
• aws lambda invoke --function-name my-function --payload '{"key":"value"}' output.json★
  Invoke a function synchronously; response goes to output.json.
• aws lambda update-function-code --function-name my-fn --zip-file fileb://fn.zip★
  Deploy new code to an existing function from a local zip.
• aws lambda get-function --function-name DynamoToSQS | jq -r .Code.Location
  Get a pre-signed URL to download the function's source code.
• aws lambda list-layers | jq -r '.Layers[] | .LayerName'
  List Lambda layers (shared libraries/dependencies).
• aws lambda list-event-source-mappings | jq -r '.EventSourceMappings[] | .FunctionArn+" "+.EventSourceArn'
  Show which event sources (SQS, Kinesis, DynamoDB) trigger each function.

• aws rds describe-db-instances | jq -r '.DBInstances[] | .DBInstanceIdentifier+" "+.DBInstanceClass+" "+.Endpoint.Address'★
  List all DB instances with class and endpoint hostname.
• aws rds describe-db-clusters | jq -r '.DBClusters[] | .DBClusterIdentifier+" "+.Endpoint'
  List Aurora clusters (multi-instance databases).
• aws rds create-db-snapshot --db-instance-identifier mydb --db-snapshot-identifier snap-$(date +%F)★
  Take a manual snapshot (backup) of a DB instance.
• aws rds describe-db-snapshots --db-instance-identifier mydb
  List snapshots for a specific DB instance.
• aws rds start-db-instance --db-instance-identifier mydb
  Start a stopped DB instance (billing resumes).
• aws rds stop-db-instance --db-instance-identifier mydb
  Stop a DB instance to pause compute billing.

• aws dynamodb list-tables | jq -r .TableNames[]★
  List all DynamoDB tables.
• aws dynamodb scan --table-name events★
  Return all items from a table (expensive on large tables — use for dev/debug).
• aws dynamodb scan --table-name events --select count | jq .ScannedCount
  Count items without fetching their data.
• aws dynamodb get-item --table-name events --key '{"email":{"S":"bob@example.com"}}'★
  Fetch one item by its primary key. Note the DynamoDB type notation ("S" = String).
• aws dynamodb put-item --table-name events --item '{"email":{"S":"bob@example.com"},"age":{"N":"30"}}'
  Insert or overwrite one item.
• aws dynamodb delete-item --table-name events --key '{"email":{"S":"bob@example.com"}}'
  Delete one item by primary key.
• aws dynamodb query --table-name events --key-condition-expression "email = :e" --expression-attribute-values '{":e":{"S":"bob@example.com"}}'
  Query items by partition key (efficient — uses the index).

• aws ecs list-clusters | jq -r .clusterArns[]★
  List ECS cluster ARNs in the region.
• aws ecs create-cluster --cluster-name my-cluster
  Create a new ECS cluster (container orchestrator).
• aws ecs list-tasks --cluster my-cluster
  List running task ARNs in a cluster.
• aws ecs create-service --cluster my-cluster --service-name web --task-definition web:1 --desired-count 2
  Deploy a service (keeps N task replicas running).
• aws eks list-clusters★
  List Kubernetes (EKS) clusters in the region.
• aws eks create-cluster --name my-k8s --role-arn arn:aws:iam::…:role/EKSRole --resources-vpc-config subnetIds=…,securityGroupIds=…
  Create a managed Kubernetes control plane.
• aws eks update-kubeconfig --name my-k8s★
  Configure kubectl to talk to this EKS cluster.
• aws eks describe-cluster --name my-k8s
  Show cluster details including endpoint and status.

• aws cloudwatch describe-alarms | jq -r '.MetricAlarms[] | .AlarmName+" "+.StateValue'★
  List all alarms and their current state (OK / ALARM / INSUFFICIENT_DATA).
• aws cloudwatch delete-alarms --alarm-names MyAlarm1 MyAlarm2
  Delete one or more alarms (up to 100 at once).
• aws logs describe-log-groups★
  List all CloudWatch log groups.
• aws logs create-log-group --log-group-name /app/prod
  Create a new log group (container for log streams).
• aws logs describe-log-streams --log-group-name /app/prod
  List streams within a log group (one stream per host/container).
• aws logs get-log-events --log-group-name /app/prod --log-stream-name i-xxx★
  Fetch recent log events from a stream.
• aws logs filter-log-events --log-group-name /app/prod --filter-pattern "ERROR"★
  Search for a pattern across all streams in a log group.
• aws logs delete-log-group --log-group-name /app/prod
  Delete a log group and all its streams permanently.

• aws route53 list-hosted-zones | jq -r '.HostedZones[] | .Id+" "+.Name'★
  List all hosted zones (DNS domains) in the account.
• aws route53 create-hosted-zone --name example.com --caller-reference $(date +%s)
  Create a new hosted zone. caller-reference is a unique ID to prevent duplicate creation.
• aws route53 list-resource-record-sets --hosted-zone-id Z1234★
  List all DNS records (A, CNAME, MX, etc.) in a zone.
• aws route53 change-resource-record-sets --hosted-zone-id Z1234 --change-batch file://records.json★
  Create / update / delete records via a JSON change-batch file.
• aws route53 delete-hosted-zone --id Z1234
  Delete a hosted zone (must be empty first).

Change-batch: use Action CREATE, UPSERT (create or update), or DELETE in the JSON file.

• aws cloudfront list-distributions | jq -r '.DistributionList.Items[] | .DomainName+" "+.Origins.Items[0].DomainName'★
  List CloudFront distributions with domain and their origin.
• aws cloudfront create-invalidation --distribution-id EDFDVBD6EXAMPLE --paths "/*"★
  Purge all cached files from edge locations — use after deploying new assets.
• aws elbv2 describe-load-balancers | jq -r '.LoadBalancers[] | .DNSName'★
  List Application/Network Load Balancer DNS names.
• aws elbv2 describe-target-groups | jq -r '.TargetGroups[] | .TargetGroupArn'
  List target groups (the registered EC2 instances/containers behind a load balancer).
• aws elbv2 describe-target-health --target-group-arn arn:aws:… | jq -r '.TargetHealthDescriptions[] | .Target.Id+" "+.TargetHealth.State'
  Check the health status of each registered target.

• aws sns list-topics | jq -r '.Topics[] | .TopicArn'★
  List all SNS topics (notification channels).
• aws sns publish --topic-arn arn:aws:sns:… --message "Deploy complete"★
  Publish a message to an SNS topic — fans out to all subscribers.
• aws sns list-subscriptions | jq -r '.Subscriptions[] | .TopicArn+" "+.Protocol+" "+.Endpoint'
  List what is subscribed to each topic (email, SQS, Lambda, HTTP…).
• aws sqs list-queues | jq -r '.QueueUrls[]'★
  List all SQS queue URLs.
• aws sqs create-queue --queue-name my-queue
  Create a new queue.
• aws sqs send-message --queue-url https://sqs.…/my-queue --message-body "hello"★
  Send a message to a queue.
• aws sqs receive-message --queue-url https://…/my-queue | jq -r '.Messages[] | .Body'★
  Poll and receive a message (dequeues up to 1 by default).
• aws sqs delete-message --queue-url https://… --receipt-handle AQE…
  Acknowledge and remove a message using its receipt handle.
• aws sqs purge-queue --queue-url https://…/my-queue
  Delete all messages from a queue instantly.

• aws cloudtrail describe-trails★
  List all CloudTrail trails (API audit logs).
• aws cloudtrail get-trail-status --name my-trail
  Is logging enabled? When did it last deliver a log file?
• aws cloudtrail create-subscription --name awslog --s3-new-bucket awslog-2026
  Create a trail that logs to a new S3 bucket.
• aws cloudtrail delete-trail --name awslog
  Delete a trail (stops logging — doesn't delete existing logs in S3).
• aws secretsmanager list-secrets | jq -r '.SecretList[] | .Name'★
  List all secrets stored in Secrets Manager.
• aws secretsmanager get-secret-value --secret-id MyDBPassword | jq -r .SecretString★
  Retrieve a secret value — use in scripts instead of hardcoding passwords.
• aws secretsmanager create-secret --name MyDBPassword --secret-string '{"user":"admin","pass":"s3cr3t"}'
  Store a new secret (JSON or plain string).
• aws secretsmanager rotate-secret --secret-id MyDBPassword
  Trigger an immediate secret rotation (requires a rotation Lambda).

• docker build -t myapp:1.0 .★
  Build an image from the Dockerfile in the current dir; -t gives it a name:tag.
• docker build -t myapp:1.0 . --no-cache
  Force a full rebuild — skips all layer cache. Use after changing base images.
• docker build -f Dockerfile.prod -t myapp:prod .
  Build from a non-default Dockerfile name.
• docker images★
  List all local images with repository, tag, ID, and size.
• docker tag myapp:1.0 myrepo/myapp:latest★
  Add a second tag to an existing image — required before pushing to a registry.
• docker pull nginx:latest★
  Download an image from Docker Hub (or any registry) to your machine.
• docker push myrepo/myapp:1.0★
  Upload an image to a registry. Must docker login first.
• docker inspect myapp:1.0
  Full JSON metadata: layers, env vars, entrypoint, exposed ports, size.
• docker history myapp:1.0
  Show each layer of an image and the command that created it.
• docker save -o myapp.tar myapp:1.0
  Export an image to a tar file for offline transfer or backup.
• docker load -i myapp.tar
  Import an image from a tar file produced by docker save.
• docker rmi myapp:1.0
  Delete a local image. Fails if a container is using it — stop it first.
• docker image prune
  Remove all dangling images (untagged layers with no container using them).
• docker image prune -a
  Remove all unused images — including tagged ones with no running container.

• docker run -d -p 8080:80 --name web nginx★
  -d detached (background), -p host:container port mapping, --name gives a friendly name.
• docker run -it --rm ubuntu /bin/bash★
  -it interactive+TTY terminal, --rm auto-deletes container on exit.
• docker run -d -e DB_HOST=localhost -v ./data:/var/data myapp★
  -e sets env var, -v host-path:container-path mounts a volume.
• docker ps★
  List running containers with ID, name, status, and ports.
• docker ps -a★
  List all containers — including stopped ones.
• docker start web / docker stop web★
  Start or stop an existing container by name or ID.
• docker restart web
  Stop then start a container — same as stop + start in one step.
• docker rm web
  Remove a stopped container. Add -f to force-remove a running one.
• docker container prune
  Remove all stopped containers in one shot.
• docker container stats
  Live CPU, memory, network, and I/O usage for all running containers.

• docker exec -it web /bin/bash★
  Open an interactive shell inside a running container — the most common debug tool.
• docker exec -it web sh
  Use sh if bash is not installed (common in alpine-based images).
• docker exec web cat /etc/hosts
  Run a one-off command inside a running container without opening a shell.
• docker logs -f web★
  Tail & follow a container's stdout/stderr. -f = follow (like tail -f).
• docker logs web --tail 100
  Show only the last 100 log lines.
• docker logs web --since 30m
  Show logs from the last 30 minutes.
• docker inspect web★
  Full JSON state of a container — IP, mounts, env vars, restart policy.
• docker inspect web | jq -r '.[0].NetworkSettings.IPAddress'
  Extract a specific field — container's internal IP address.
• docker cp web:/app/config.json ./config.json
  Copy a file from a container to your host. Reverse args to copy in.
• docker port web
  Show which host ports are mapped to which container ports.
• docker top web
  List processes running inside a container (like ps aux inside).
• docker diff web
  Show filesystem changes made inside a container since it started.

• docker volume create mydata★
  Create a named volume — survives container removal; managed by Docker.
• docker volume ls
  List all volumes on the host.
• docker volume inspect mydata
  Show where the volume is stored on disk and which containers use it.
• docker run -d -v mydata:/var/lib/postgresql/data postgres★
  Mount a named volume into a container — data persists after the container stops.
• docker volume rm mydata
  Delete a volume and all its data permanently.
• docker network create mynet★
  Create a user-defined bridge network — containers on the same network find each other by name.
• docker network ls
  List all Docker networks (bridge, host, none, custom).
• docker run -d --network mynet --name api myapp
  Attach a container to a network at start. It can reach other containers by their names.
• docker network connect mynet web
  Attach a running container to an additional network.
• docker network inspect mynet
  Show subnet, gateway, and which containers are connected.

DNS tip: containers on a user-defined network resolve each other by container name. E.g. api can reach db at http://db:5432.

• docker compose up -d★
  Start all services defined in docker-compose.yml in detached mode.
• docker compose up --build
  Rebuild images before starting — use after changing a Dockerfile.
• docker compose down★
  Stop and remove containers, networks defined in the compose file.
• docker compose down -v
  Also removes named volumes declared in the compose file.
• docker compose ps
  List service containers and their status.
• docker compose logs -f api
  Follow logs from a specific service.
• docker compose exec api /bin/sh
  Shell into a running service container from compose.
• docker system prune★
  Remove stopped containers, unused networks, dangling images, and build cache.
• docker system prune -a --volumes
  Nuclear cleanup — also removes all unused images and volumes. Frees most disk space.
• docker system df
  Show how much disk space Docker is using (images, containers, volumes, cache).

• aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com★
  The canonical ECR login. Pipes a 12-hour token directly into Docker. Replace account ID and region.
• aws ecr get-login-password --region us-east-1 --profile prod | docker login --username AWS --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com
  Same but uses a named AWS profile (multi-account setups).
• aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
  Authenticate to the ECR Public Gallery — must always use us-east-1.

Token lifetime: authorization tokens are valid for 12 hours. In CI/CD pipelines, run the login step fresh at the start of every job.
IAM needed: ecr:GetAuthorizationToken + repo permissions (ecr:BatchGetImage, ecr:PutImage…).

• aws ecr describe-repositories | jq -r '.repositories[] | .repositoryName+" "+.repositoryUri'★
  List all private repos and their full push/pull URIs.
• aws ecr create-repository --repository-name my-app --region us-east-1★
  Create a new private repo. ECR repo must exist before you can push to it.
• aws ecr create-repository --repository-name my-app --image-tag-mutability IMMUTABLE
  Create with immutable tags — prevents overwriting an existing tag (recommended for production).
• aws ecr create-repository --repository-name my-app --image-scanning-configuration scanOnPush=true
  Auto-scan images for CVEs on every push.
• aws ecr describe-repositories --repository-names my-app
  Details for a specific repo: URI, mutability setting, scan config.
• aws ecr get-repository-policy --repository-name my-app
  Show the resource-based policy (who can pull from this repo).
• aws ecr delete-repository --repository-name my-app --force
  ⚠ Delete repo and all its images. --force skips the "repo must be empty" guard.

• # 1️⃣ Authenticate (12-hour token)
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $ACCOUNT.dkr.ecr.us-east-1.amazonaws.com★
  Step 1: get a token and hand it straight to Docker.
• # 2️⃣ Build locally
docker build -t my-app:v2 .★
  Step 2: build the image with a meaningful local tag.
• # 3️⃣ Tag for ECR
docker tag my-app:v2 $ACCOUNT.dkr.ecr.us-east-1.amazonaws.com/my-app:v2★
  Step 3: retag with the full ECR URI. ECR URI = <account>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>.
• # 4️⃣ Push
docker push $ACCOUNT.dkr.ecr.us-east-1.amazonaws.com/my-app:v2★
  Step 4: upload to ECR. Only changed layers are transferred.
• # Pull back (from any machine)
docker pull $ACCOUNT.dkr.ecr.us-east-1.amazonaws.com/my-app:v2★
  Pull to any authenticated Docker host (re-auth first).

Shortcut: in the ECR console, open your repo and click View push commands — it generates all 4 steps with your exact account/region filled in.

• aws ecr list-images --repository-name my-app | jq -r '.imageIds[] | .imageTag'★
  List all image tags in a repo.
• aws ecr describe-images --repository-name my-app --query 'imageDetails[].[imageTags[0],imagePushedAt,imageSizeInBytes]' --output table★
  Table of tag, push date, and size — great for auditing.
• aws ecr start-image-scan --repository-name my-app --image-id imageTag=v2
  Trigger a manual CVE scan of a specific image tag.
• aws ecr describe-image-scan-findings --repository-name my-app --image-id imageTag=v2 | jq '.imageScanFindings.findingSeverityCounts'★
  Show CVE severity counts (CRITICAL / HIGH / MEDIUM / LOW) from the scan.
• aws ecr batch-delete-image --repository-name my-app --image-ids imageTag=old-tag
  Delete one or more images by tag (or by digest).
• aws ecr put-lifecycle-policy --repository-name my-app --lifecycle-policy-text file://policy.json
  Apply a lifecycle policy — auto-expire untagged images older than N days.
• aws ecr get-lifecycle-policy --repository-name my-app
  Inspect the current lifecycle policy for a repository.
• aws ecr put-image-tag-mutability --repository-name my-app --image-tag-mutability IMMUTABLE
  Lock tags on an existing repo — once pushed, a tag cannot be overwritten.