Awscli

AWS CLI

The AWS CLI allows you to control AWS services from the command line. In 2025, usage is centered around AWS IAM Identity Center (formerly SSO) for secure, short-lived credentials.

When to Use

• Scripting: Automate S3 uploads (aws s3 sync).
• DevOps: Debugging permissions or inspecting resources without the Console UI.
• CI/CD: Deploying CloudFormation/CDK stacks (though specialized tools are often better).

Quick Start

# Install v2
curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
sudo installer -pkg AWSCLIV2.pkg -target /

# Configure with SSO (Recommended 2025)
aws configure sso
# SSO session name: my-session
# SSO start URL: https://my-org.awsapps.com/start
# SSO region: us-east-1
# Registration scopes: sso:account:access

# Login daily
aws sso login --profile my-profile

Core Concepts

Profiles

Managed in ~/.aws/config. Allow switching between Prod, Staging, and Dev accounts easily. export AWS_PROFILE=prod

Query (--query)

Built-in JMESPath filtering. Use it instead of piping to jq for simple lookups. aws ec2 describe-instances --query "Reservations[*].Instances[*].PublicIpAddress"

S3 Web Viewer

aws s3 presign s3://my-bucket/file.txt generates a temporary public URL.

Best Practices (2025)

Do:

• Use AWS SSO: Stop using long-lived aws_access_key_id CSVs. They are the #1 cause of hacks.
• Use aws-vault: If you must use keys, wrap them in aws-vault to store them in the OS keychain.
• Update v2: Ensure you are on v2.x. v1 is deprecated.

Don't:

• Don't parse text output: Always use --output json and a parser (jq or --query). Text output format changes.

References

• AWS CLI Documentation