☁️

AWS CLI

AWS CLI commands across S3, EC2, IAM, ECS, Lambda, RDS, CloudWatch and more

S3 — Buckets & Objects

Create, list, copy, sync and delete S3 resources

bash·List all buckets

aws s3 ls

bash·List bucket contents (recursive)

aws s3 ls s3://<bucket>/ --recursive --human-readable

bash·Create bucket

aws s3 mb s3://<bucket> --region <region>

bash·Remove empty bucket

aws s3 rb s3://<bucket>

bash·Remove bucket and all contents

aws s3 rb s3://<bucket> --force

bash·Upload file

aws s3 cp ./file.txt s3://<bucket>/path/

bash·Download file

aws s3 cp s3://<bucket>/path/file.txt ./file.txt

bash·Sync local → S3 (delete removed files)

aws s3 sync ./local-dir s3://<bucket>/prefix --delete

bash·Sync S3 → local

aws s3 sync s3://<bucket>/prefix ./local-dir

bash·Delete object

aws s3 rm s3://<bucket>/path/file.txt

bash·Delete all objects under prefix

aws s3 rm s3://<bucket>/prefix/ --recursive

bash·Generate presigned URL (1 hour)

aws s3 presign s3://<bucket>/file.txt --expires-in 3600

EC2 — Instances

Describe, start, stop, and connect to EC2 instances

bash·List instances (table view)

aws ec2 describe-instances \
  --query "Reservations[*].Instances[*].[InstanceId,State.Name,InstanceType,PublicIpAddress,Tags[?Key=='Name'].Value|[0]]" \
  --output table

bash·Start instance

aws ec2 start-instances --instance-ids <id>

bash·Stop instance

aws ec2 stop-instances --instance-ids <id>

bash·Reboot instance

aws ec2 reboot-instances --instance-ids <id>

bash·Terminate instance

aws ec2 terminate-instances --instance-ids <id>

bash·Get instance public IP

aws ec2 describe-instances --instance-ids <id> \
  --query "Reservations[0].Instances[0].PublicIpAddress" --output text

bash·Connect via SSM Session Manager

aws ssm start-session --target <instance-id>

bash·List security groups

aws ec2 describe-security-groups \
  --query "SecurityGroups[*].[GroupId,GroupName,Description]" --output table

bash·List key pairs

aws ec2 describe-key-pairs --query "KeyPairs[*].KeyName" --output table

IAM — Users, Roles & Policies

Manage IAM identities and permissions

bash·List users

aws iam list-users --query "Users[*].[UserName,UserId,CreateDate]" --output table

bash·Create user

aws iam create-user --user-name <username>

bash·Delete user

aws iam delete-user --user-name <username>

bash·List roles

aws iam list-roles --query "Roles[*].[RoleName,Arn]" --output table

bash·Get caller identity (who am I?)

aws sts get-caller-identity

bash·Attach managed policy to user

aws iam attach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/<PolicyName>

bash·List attached policies for user

aws iam list-attached-user-policies --user-name <username>

bash·Create access key for user

aws iam create-access-key --user-name <username>

bash·List access keys

aws iam list-access-keys --user-name <username>

bash·Assume role (get temp credentials)

aws sts assume-role \
  --role-arn arn:aws:iam::<account-id>:role/<role-name> \
  --role-session-name my-session

ECS — Clusters & Services

Deploy and manage containers with ECS

bash·List clusters

aws ecs list-clusters

bash·List services in cluster

aws ecs list-services --cluster <cluster-name>

bash·Describe service

aws ecs describe-services --cluster <cluster> --services <service>

bash·Force new deployment

aws ecs update-service --cluster <cluster> --service <service> --force-new-deployment

bash·Scale service

aws ecs update-service --cluster <cluster> --service <service> --desired-count 3

bash·List running tasks

aws ecs list-tasks --cluster <cluster> --service-name <service>

bash·Stop a task

aws ecs stop-task --cluster <cluster> --task <task-id> --reason "manual stop"

bash·Execute command in task (ECS Exec)

aws ecs execute-command \
  --cluster <cluster> --task <task-id> \
  --container <container-name> \
  --command "/bin/sh" --interactive

Lambda — Functions

Deploy, invoke and monitor Lambda functions

bash·List functions

aws lambda list-functions --query "Functions[*].[FunctionName,Runtime,LastModified]" --output table

bash·Invoke function (sync)

aws lambda invoke --function-name <name> --payload '{"key":"value"}' /tmp/response.json && cat /tmp/response.json

bash·Invoke function (async)

aws lambda invoke --function-name <name> --invocation-type Event --payload '{}' /tmp/out.json

bash·Update function code from zip

aws lambda update-function-code --function-name <name> --zip-file fileb://function.zip

bash·Update environment variable

aws lambda update-function-configuration \
  --function-name <name> \
  --environment "Variables={KEY=value,OTHER=value}"

bash·Get function configuration

aws lambda get-function-configuration --function-name <name>

bash·Tail live logs via CloudWatch

aws logs tail /aws/lambda/<name> --follow

RDS — Databases

Manage RDS instances and snapshots

bash·List DB instances

aws rds describe-db-instances --query "DBInstances[*].[DBInstanceIdentifier,DBInstanceStatus,Engine,Endpoint.Address]" --output table

bash·Start DB instance

aws rds start-db-instance --db-instance-identifier <id>

bash·Stop DB instance

aws rds stop-db-instance --db-instance-identifier <id>

bash·Create manual snapshot

aws rds create-db-snapshot --db-instance-identifier <id> --db-snapshot-identifier <snapshot-id>

bash·List snapshots

aws rds describe-db-snapshots --db-instance-identifier <id> --query "DBSnapshots[*].[DBSnapshotIdentifier,Status,SnapshotCreateTime]" --output table

bash·Restore from snapshot

aws rds restore-db-instance-from-db-snapshot \
  --db-instance-identifier <new-id> \
  --db-snapshot-identifier <snapshot-id>

CloudWatch — Logs & Metrics

Query logs and metrics from CloudWatch

bash·List log groups

aws logs describe-log-groups --query "logGroups[*].logGroupName" --output table

bash·Tail log group (live)

aws logs tail <log-group-name> --follow

bash·Filter log events

aws logs filter-log-events \
  --log-group-name <group> \
  --filter-pattern "ERROR" \
  --start-time $(date -d '1 hour ago' +%s000)

bash·Run Logs Insights query

aws logs start-query \
  --log-group-name <group> \
  --start-time $(date -d '1 hour ago' +%s) \
  --end-time $(date +%s) \
  --query-string 'fields @timestamp, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 20'

bash·Get Logs Insights results

aws logs get-query-results --query-id <query-id>

bash·Get metric statistics (CPU last hour)

aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=<instance-id> \
  --start-time $(date -u -d '1 hour ago' +%FT%TZ) \
  --end-time $(date -u +%FT%TZ) \
  --period 300 --statistics Average

ECR — Container Registry

Push and pull Docker images to/from ECR

bash·Authenticate Docker to ECR

aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <account-id>.dkr.ecr.<region>.amazonaws.com

bash·Create repository

aws ecr create-repository --repository-name <name> --region <region>

bash·List repositories

aws ecr describe-repositories --query "repositories[*].[repositoryName,repositoryUri]" --output table

bash·Tag & push image

docker tag <local-image>:<tag> <account-id>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>
docker push <account-id>.dkr.ecr.<region>.amazonaws.com/<repo>:<tag>

bash·List images in repository

aws ecr list-images --repository-name <name> --query "imageIds[*].[imageTag,imageDigest]" --output table

bash·Delete image

aws ecr batch-delete-image --repository-name <name> --image-ids imageTag=<tag>

VPC & Networking

Inspect VPCs, subnets, and route tables

bash·List VPCs

aws ec2 describe-vpcs --query "Vpcs[*].[VpcId,CidrBlock,Tags[?Key=='Name'].Value|[0]]" --output table

bash·List subnets

aws ec2 describe-subnets --query "Subnets[*].[SubnetId,VpcId,CidrBlock,AvailabilityZone]" --output table

bash·List route tables

aws ec2 describe-route-tables --query "RouteTables[*].[RouteTableId,VpcId]" --output table

bash·List internet gateways

aws ec2 describe-internet-gateways --query "InternetGateways[*].[InternetGatewayId,Attachments[0].VpcId]" --output table

bash·Describe network ACLs

aws ec2 describe-network-acls --query "NetworkAcls[*].[NetworkAclId,VpcId,IsDefault]" --output table

SSM Parameter Store & Secrets

Read and write secrets and config from SSM

bash·Get parameter (decrypted)

aws ssm get-parameter --name /my/param --with-decryption --query Parameter.Value --output text

bash·Get all parameters by path

aws ssm get-parameters-by-path --path /my/app/ --with-decryption --recursive

bash·Put parameter (SecureString)

aws ssm put-parameter --name /my/param --value 'secret' --type SecureString --overwrite

bash·Delete parameter

aws ssm delete-parameter --name /my/param

bash·Get secret from Secrets Manager

aws secretsmanager get-secret-value --secret-id <secret-name> --query SecretString --output text

bash·List secrets

aws secretsmanager list-secrets --query "SecretList[*].[Name,LastChangedDate]" --output table