What Is the AWS CLI?

The AWS CLI, or Amazon Web Services Command Line Interface, is a terminal tool for managing AWS services from a shell, script, local development environment, CI/CD pipeline, jump host, or cloud workstation. Instead of clicking through the AWS Management Console, you type commands such as aws s3 ls, aws ec2 describe-instances, or aws sts get-caller-identity. This is faster for repeatable tasks, safer for documented operations, and more scalable for teams that need consistent infrastructure workflows.

For candidates preparing for AWS, DevOps, cloud support, site reliability engineering, backend engineering, or platform engineering roles, the CLI is more than a convenience. It shows whether you understand resources, regions, identities, permissions, output formats, filters, and automation. A candidate who can explain aws s3 sync, --profile, --region, --query, and aws sts get-caller-identity usually understands AWS operational fundamentals better than someone who only memorizes console screenshots.

The Four-Part Mental Model

AWS CLI has two broad command styles. High-level commands are friendlier wrappers, most commonly in the aws s3 namespace. They use commands like cp, mv, rm, sync, ls, mb, and rb. Low-level service commands generally mirror AWS service APIs more closely, such as aws s3api list-objects-v2, aws ec2 describe-security-groups, or aws iam list-users. A strong user knows both: high-level commands for daily file workflows, and service API commands for precision, scripting, and advanced output filtering.

Install, Verify, and Configure AWS CLI

In modern AWS workflows, use AWS CLI version 2 unless a legacy team script explicitly requires version 1. Version 2 includes current CLI behavior, built-in improvements, IAM Identity Center support, auto-prompt, additional output formats, and a more consistent experience across operating systems. Candidates should know how to check the installed version, configure credentials, select a profile, verify the caller identity, and avoid committing secrets to source control.

aws --version

aws configure

aws configure sso

aws sts get-caller-identity

aws configure list-profiles

aws s3 ls --profile dev

Files Created by Configuration

Basic configuration usually writes to two files in the user home directory. The ~/.aws/config file stores profile settings such as region and output. The ~/.aws/credentials file can store access keys for profiles when static IAM user credentials are used. In production-grade environments, avoid long-lived credentials when possible. Prefer IAM roles, IAM Identity Center, short-lived credentials, workload identity, or CI-provided temporary credentials.

[default]
region = us-east-1
output = json

[profile dev]
region = ap-south-1
output = table

Global Options Every Candidate Should Know

Global options work across many AWS CLI commands. These are important in interviews because they reveal whether you understand repeatability. A command without --region may work on one laptop but fail on another. A command without --profile may run against the wrong account. A command without --query may return too much output. A command without --output may be hard to read or hard to parse in automation.

Environment Variables

Environment variables let you override local settings temporarily. This is common in shell sessions, Docker containers, CI pipelines, and automated jobs. Use them carefully because they can hide the true source of credentials from beginners.

export AWS_PROFILE=dev
export AWS_REGION=us-east-1
export AWS_DEFAULT_OUTPUT=json
export AWS_PAGER=""

A useful candidate habit is to run aws configure list and aws sts get-caller-identity before making changes. These two commands answer two critical questions: which configuration is active, and which AWS principal is authorized to act?

Interactive AWS CLI Command Finder

Filter by topic or search directly. Each card includes a safe template. Replace placeholder names such as my-bucket, my-profile, i-1234567890abcdef0, my-function, and us-east-1 before running commands. Copy buttons use your browser clipboard.

aws s3 ls

aws s3 ls s3://my-bucket/path/ --recursive

aws s3 cp ./file.pdf s3://my-bucket/folder/file.pdf

aws s3 cp s3://my-bucket/folder/file.pdf ./file.pdf

aws s3 sync ./dist s3://my-bucket --delete

aws s3 sync ./dist s3://my-bucket --dryrun

aws s3 mb s3://my-unique-bucket-name --region us-east-1

aws s3 rm s3://my-bucket/path/ --recursive --dryrun

aws ec2 describe-instances --output table

aws ec2 describe-instances \
  --query "Reservations[*].Instances[*].{ID:InstanceId,State:State.Name,Type:InstanceType,AZ:Placement.AvailabilityZone,PublicIP:PublicIpAddress}" \
  --output table

aws ec2 start-instances --instance-ids i-1234567890abcdef0

aws ec2 stop-instances --instance-ids i-1234567890abcdef0

aws ec2 describe-security-groups \
  --group-ids sg-1234567890abcdef0 \
  --output table

aws ec2 describe-volumes \
  --query "Volumes[*].{ID:VolumeId,State:State,Size:Size,Type:VolumeType}" \
  --output table

aws iam list-users --output table

aws iam list-roles --query "Roles[*].RoleName" --output table

aws iam list-attached-user-policies --user-name my-user

aws iam list-access-keys --user-name my-user

aws lambda list-functions \
  --query "Functions[*].FunctionName" \
  --output table

aws lambda invoke \
  --function-name my-function \
  --payload '{"ping":"test"}' \
  response.json

aws lambda update-function-code \
  --function-name my-function \
  --zip-file fileb://function.zip

aws cloudformation deploy \
  --template-file template.yaml \
  --stack-name my-stack \
  --capabilities CAPABILITY_NAMED_IAM

aws cloudformation describe-stacks \
  --stack-name my-stack \
  --query "Stacks[0].Outputs" \
  --output table

aws cloudformation validate-template \
  --template-body file://template.yaml

aws logs tail /aws/lambda/my-function --follow

aws logs describe-log-groups \
  --query "logGroups[*].logGroupName" \
  --output table

aws dynamodb list-tables --output table

aws dynamodb describe-table --table-name my-table

aws rds describe-db-instances \
  --query "DBInstances[*].{DB:DBInstanceIdentifier,Engine:Engine,Status:DBInstanceStatus,Class:DBInstanceClass}" \
  --output table

aws ecr get-login-password --region us-east-1 | \
docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com

aws ecr describe-repositories \
  --query "repositories[*].repositoryName" \
  --output table

aws ecs list-clusters --output table

aws eks update-kubeconfig \
  --name my-cluster \
  --region us-east-1

aws secretsmanager get-secret-value \
  --secret-id my-secret \
  --query SecretString \
  --output text

aws kms list-keys --output table

aws ssm get-parameter \
  --name /app/prod/db-url \
  --with-decryption

aws route53 list-hosted-zones --output table

aws elbv2 describe-load-balancers \
  --query "LoadBalancers[*].{Name:LoadBalancerName,DNS:DNSName,State:State.Code}" \
  --output table

aws cloudtrail lookup-events \
  --max-results 10 \
  --output table

AWS S3 CLI Commands Cheat Sheet

Amazon S3 is one of the most searched AWS CLI topics because file operations are common in development, analytics, deployment, backups, static hosting, and data engineering. Candidates should distinguish aws s3 and aws s3api. The aws s3 commands are high-level and feel similar to local file operations. The aws s3api commands map more closely to the S3 API and expose more precise options.

Common S3 Patterns

# List buckets
aws s3 ls

# List one bucket path
aws s3 ls s3://my-bucket/folder/

# Upload one file
aws s3 cp report.pdf s3://my-bucket/reports/report.pdf

# Download one file
aws s3 cp s3://my-bucket/reports/report.pdf ./report.pdf

# Upload a folder recursively
aws s3 cp ./assets s3://my-bucket/assets --recursive

# Sync local folder to S3
aws s3 sync ./dist s3://my-bucket --delete

# Preview sync first
aws s3 sync ./dist s3://my-bucket --dryrun

# Remove objects under a prefix
aws s3 rm s3://my-bucket/tmp/ --recursive --dryrun

S3 Safety Checklist

• Use --dryrun before large copy, sync, or delete operations. This is the simplest way to prevent accidental data loss.
• Confirm account identity. Run aws sts get-caller-identity before production operations.
• Confirm region and bucket ownership. S3 bucket names are globally unique, and similar names can cause mistakes.
• Understand --delete. It makes the destination match the source by removing destination files that no longer exist in the source.
• Use versioning for critical buckets. Versioning can reduce risk from accidental overwrites and deletes.

AWS Services List Cheat Sheet for CLI Users

AWS CLI service names are not always identical to product names. For example, Elastic Load Balancing v2 uses elbv2, CloudWatch Logs uses logs, Systems Manager uses ssm, and Secrets Manager uses secretsmanager. Candidates should know the most common service namespaces because they make command discovery faster.

Output, Query, Pagination, and Filtering

The --query option is one of the highest-value AWS CLI skills. It lets you filter a JSON response before displaying it. The query language is JMESPath. You do not need to become a JMESPath expert on day one, but you should know how to select fields, flatten arrays, create readable labels, filter by values, and change output format.

Output Formats

Use json when a script or tool will process the result. Use table when a human needs to read a summary quickly. Use text for shell pipelines. Use yaml when the structure should be readable and compatible with YAML-focused tooling. Use yaml-stream for large responses where streaming helps responsiveness. Use off in automation cases where the exit code matters and stdout should stay quiet.

aws ec2 describe-instances \
  --query "Reservations[*].Instances[*].InstanceId" \
  --output text

aws ec2 describe-instances \
  --query "Reservations[*].Instances[*].{ID:InstanceId,State:State.Name,Type:InstanceType}" \
  --output table

aws ec2 describe-instances \
  --query "Reservations[*].Instances[?State.Name=='running'].InstanceId" \
  --output text

aws s3api list-objects-v2 \
  --bucket my-bucket \
  --max-items 100

Server-Side Filters vs Client-Side Queries

A server-side filter is handled by the AWS service before the response is returned. It can reduce network traffic and speed up large result sets. A client-side query is handled by the AWS CLI after the response is received. It is excellent for formatting and final shaping, but it does not reduce the service-side work. A mature command often combines both.

# Server-side filter: ask EC2 for running instances
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running"

# Client-side query: shape the response into a readable table
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query "Reservations[*].Instances[*].{ID:InstanceId,Type:InstanceType,AZ:Placement.AvailabilityZone}" \
  --output table

Pagination Strategy

Most list-style commands can return many results. The AWS CLI may automatically call the service multiple times to retrieve all pages. Use --page-size when individual service calls time out. Use --max-items when you want fewer items printed. Use --starting-token when continuing from a previous paged response. Avoid mixing incompatible values for --page-size and --max-items unless you understand the consequences for ordering and duplicate or missing items.

AWS CLI for Automation, GitHub Actions, and CI/CD

Automation is where AWS CLI becomes especially valuable. A single command can deploy files, trigger infrastructure updates, fetch parameters, rotate artifacts, or verify a release. However, automated commands must be stricter than manual commands. Always define the profile or role, region, output behavior, error handling, and cleanup behavior. CI/CD jobs should use short-lived credentials and least-privilege policies.

Safe Bash Script Pattern

#!/usr/bin/env bash
set -euo pipefail

export AWS_REGION="us-east-1"

echo "Checking active AWS identity..."
aws sts get-caller-identity --output table

echo "Validating template..."
aws cloudformation validate-template --template-body file://template.yaml

echo "Deploying stack..."
aws cloudformation deploy \
  --template-file template.yaml \
  --stack-name my-stack \
  --capabilities CAPABILITY_NAMED_IAM \
  --no-cli-pager

Static Website Deploy Pattern

# Build your app first, then preview
npm run build
aws s3 sync ./dist s3://my-static-site-bucket --dryrun

# Deploy after checking the dry run output
aws s3 sync ./dist s3://my-static-site-bucket --delete

# Optional CloudFront invalidation
aws cloudfront create-invalidation \
  --distribution-id E1234567890ABC \
  --paths "/*"

GitHub Actions Conceptual Pattern

In GitHub Actions, avoid storing long-lived AWS access keys where possible. Prefer OpenID Connect with an AWS IAM role that trusts the GitHub repository and workflow context. The CLI commands inside the workflow should still be explicit about region, stack names, S3 paths, and output formats. A candidate does not need to memorize every YAML line, but should understand the principle: CI assumes a temporary role, then runs deterministic CLI commands.

# Conceptual deploy steps inside CI
aws sts get-caller-identity
aws cloudformation deploy --template-file template.yaml --stack-name app-prod --capabilities CAPABILITY_NAMED_IAM
aws s3 sync ./dist s3://app-prod-assets --delete

Automation Rules

• Use explicit regions. Do not rely on hidden defaults in production scripts.
• Use explicit identities. Verify the caller before making infrastructure changes.
• Use dry runs where supported. Especially for S3 copy, sync, and remove commands.
• Fail fast. In shell scripts, use set -euo pipefail and handle expected non-zero cases clearly.
• Do not print secrets. Mask secret output, avoid debug logs around secrets, and restrict CI log access.
• Prefer roles over long-lived keys. Temporary credentials reduce blast radius.

AWS CLI Security Cheat Sheet

AWS CLI security is mostly about identity, permissions, logging, and safe handling of credentials. The CLI itself does what the active credentials permit. That means the same command can be harmless in a sandbox account and destructive in production. Candidates should always explain how they confirm account, principal, region, action scope, and rollback options.

High-Value Security Commands

# Confirm current principal
aws sts get-caller-identity

# List policies attached to a role
aws iam list-attached-role-policies --role-name my-role

# Get account password policy
aws iam get-account-password-policy

# List access keys for a user
aws iam list-access-keys --user-name my-user

# Get CloudTrail recent events
aws cloudtrail lookup-events --max-results 20 --output table

# Read a secure SSM parameter only when authorized
aws ssm get-parameter --name /app/prod/api-key --with-decryption

Least-Privilege Interview Answer

A strong candidate answer sounds like this: “Before I run the command, I confirm the AWS account and role with aws sts get-caller-identity, specify --region, use a named --profile or temporary role, prefer read-only commands first, preview changes with dry runs or change sets, and ensure IAM permissions are scoped to the exact resources needed.”

Secrets Handling

When commands retrieve sensitive data from Secrets Manager, SSM Parameter Store, or KMS-protected resources, avoid printing output to shared screens or logs. Use environment variables carefully. Avoid shell history leaks. In Bash, a leading space may prevent history storage in some shell configurations, but do not rely on that as a security control. The better approach is to design workflows that do not display secrets at all.

Troubleshooting AWS CLI Errors

AWS CLI errors usually come from one of seven causes: missing credentials, wrong profile, wrong region, insufficient permissions, invalid parameters, service-side resource state, or network configuration. Troubleshooting should be systematic. Do not randomly add administrator permissions. Diagnose the active identity, region, command syntax, and API error message first.

Diagnostic Sequence

# 1. Confirm CLI version
aws --version

# 2. Check profile and config sources
aws configure list

# 3. Confirm active identity
aws sts get-caller-identity

# 4. Confirm region
aws configure get region

# 5. Run read-only command first
aws ec2 describe-regions --output table

# 6. Add debug only when needed
aws s3 ls --debug

Candidate Study Guide: What You Need to Know

A candidate does not need to memorize every AWS CLI command. AWS has too many services for that approach. Instead, learn patterns. Know how to get help, how to identify the current caller, how to list resources, how to filter output, how to change regions, and how to apply safe automation habits. Most AWS CLI tasks are variations of the same pattern: describe, list, get, put, create, update, delete, wait, and tag.

Command Verbs to Recognize

Interview Questions and Strong Answers

Practice Tasks

These tasks help a candidate move from reading to real command fluency. Use a sandbox AWS account or training environment. Do not practice destructive commands in production.

1. Install AWS CLI v2 and run aws --version.
2. Create or select a training profile, then run aws configure list-profiles.
3. Run aws sts get-caller-identity and write down the account ID.
4. List S3 buckets with aws s3 ls.
5. Create a test bucket only if your training account allows it.
6. Upload a small file with aws s3 cp.
7. Preview a folder sync with aws s3 sync --dryrun.
8. List EC2 instances and use --query to show only ID, state, type, and availability zone.
9. List CloudWatch log groups and tail a test Lambda log group.
10. Write a small shell script that checks identity, validates a CloudFormation template, and prints stack outputs.

Deep Notes for Better Ranking and Better Learning

The fastest way to become fluent with AWS CLI is to treat every command as a small API request. The service namespace tells AWS where the request is going, the operation tells AWS what action is requested, and the parameters provide the resource names, identifiers, filters, or input files. This mental model makes new commands easier to learn. If you know aws ec2 describe-instances, you can understand aws rds describe-db-instances, aws elbv2 describe-load-balancers, and aws logs describe-log-groups because they follow the same read-only inventory pattern.

A good cheat sheet should not only list commands; it should teach decision-making. For example, aws s3 sync is powerful, but the decision to use --delete depends on whether the S3 destination should exactly match the local source. That is correct for many static website deployments, but risky for shared buckets or backup locations. Similarly, --output table is excellent for manual inspection, while --output json is more reliable for automation. A candidate who can explain these tradeoffs is stronger than a candidate who only memorizes command text.

In real projects, AWS CLI is often used with infrastructure-as-code tools rather than replacing them. Terraform, AWS CDK, CloudFormation, and Pulumi may own infrastructure state, while AWS CLI is used to verify outputs, inspect logs, upload assets, invalidate CloudFront distributions, or perform operational diagnostics. The safest rule is simple: if a resource is managed by infrastructure as code, avoid manual changes that create drift unless the change is part of an approved emergency procedure and is later reconciled back into code.

For production environments, logging and auditability matter. AWS CLI calls are AWS API calls, so they can appear in CloudTrail when the service records them. This makes the CLI suitable for controlled operations when identities, roles, and permissions are properly managed. However, shell history, terminal scrollback, CI logs, and screenshots can still leak information. Avoid placing secrets directly in commands. Prefer files, secure stores, masked variables, and short-lived credentials. When using --debug, remember that diagnostic output can include sensitive request details.

For learning, build a three-level progression. Level one is safe reading: list, describe, and get commands. Level two is controlled writing: upload a file to S3, deploy a small test stack, update a Lambda function in a sandbox, or create a test parameter. Level three is operational automation: combine identity checks, validation, dry runs, deployment, output capture, and log inspection in a repeatable script. This progression develops confidence without encouraging reckless production experimentation.

Finally, every AWS CLI learner should practice reading command help. Use aws help, aws s3 help, and aws ec2 describe-instances help. The help pages explain parameters, examples, pagination, output, and required values. When AWS adds or changes service features, the command reference and help output are more reliable than old blog snippets. A cheat sheet is the map; official command help is the live reference.

Official Learning Resources

For long-term accuracy, candidates should use official AWS references whenever a command changes or a service adds new parameters.

• AWS CLI install and update instructions
• AWS CLI setup guide
• AWS CLI command reference
• AWS CLI filtering output guide
• AWS CLI pagination guide
• AWS CLI S3 command reference

FAQ: AWS CLI Cheat Sheet