AWS CLI Cheat Sheet

A quick reference for common AWS CLI commands.

CommandDescription
aws s3 lsList all S3 buckets.
aws s3 ls s3://[bucket-name]List objects in a bucket.
aws s3 mb s3://[bucket-name]Create an S3 bucket.
aws s3 rb s3://[bucket-name]Delete an S3 bucket.
aws s3 cp [file] s3://[bucket-name]Copy a file to an S3 bucket.
aws s3 cp s3://[bucket-name]/[file] [destination]Copy a file from an S3 bucket.
aws s3 mv [file] s3://[bucket-name]Move a file to an S3 bucket.
aws s3 rm s3://[bucket-name]/[file]Delete a file from an S3 bucket.
aws s3 sync [folder] s3://[bucket-name]Sync a folder with an S3 bucket.
aws s3 presign s3://[bucket-name]/[file]Generate a presigned URL for a file.

CommandDescription
aws ec2 describe-instancesDescribe all EC2 instances.
aws ec2 run-instances --image-id [ami-id] --instance-type [type] --key-name [key-name]Launch an EC2 instance.
aws ec2 start-instances --instance-ids [instance-id]Start an EC2 instance.
aws ec2 stop-instances --instance-ids [instance-id]Stop an EC2 instance.
aws ec2 reboot-instances --instance-ids [instance-id]Reboot an EC2 instance.
aws ec2 terminate-instances --instance-ids [instance-id]Terminate an EC2 instance.
aws ec2 describe-vpcsDescribe all VPCs.
aws ec2 describe-subnetsDescribe all subnets.
aws ec2 describe-security-groupsDescribe all security groups.
aws ec2 create-key-pair --key-name [key-name]Create a new EC2 key pair.

CommandDescription
aws iam list-usersList all IAM users.
aws iam create-user --user-name [username]Create a new IAM user.
aws iam delete-user --user-name [username]Delete an IAM user.
aws iam list-rolesList all IAM roles.
aws iam create-role --role-name [rolename] --assume-role-policy-document file://[policy.json]Create a new IAM role.
aws iam attach-role-policy --role-name [rolename] --policy-arn [policy-arn]Attach a policy to an IAM role.
aws iam list-policiesList all IAM policies.

CommandDescription
aws lambda list-functionsList all Lambda functions.
aws lambda invoke --function-name [function-name] [output-file]Invoke a Lambda function.
aws lambda create-function --function-name [name] --runtime [runtime] --role [role-arn] --handler [handler] --zip-file fileb://[package.zip]Create a new Lambda function.
aws lambda delete-function --function-name [function-name]Delete a Lambda function.
aws lambda get-function-configuration --function-name [function-name]Get configuration for a Lambda function.

CommandDescription
aws cloudformation create-stack --stack-name [name] --template-body file://[template.yaml]Create a new CloudFormation stack.
aws cloudformation update-stack --stack-name [name] --template-body file://[template.yaml]Update an existing CloudFormation stack.
aws cloudformation delete-stack --stack-name [name]Delete a CloudFormation stack.
aws cloudformation describe-stacks --stack-name [name]Describe a CloudFormation stack.
aws cloudformation validate-template --template-body file://[template.yaml]Validate a CloudFormation template.

CommandDescription
aws logs describe-log-groupsList all log groups.
aws logs describe-log-streams --log-group-name [log-group-name]List log streams in a log group.
aws logs get-log-events --log-group-name [log-group-name] --log-stream-name [log-stream-name]Get log events from a log stream.
aws logs tail [log-group-name]Tail log events in real-time.

CommandDescription
aws sqs list-queuesLists all your SQS queues.
aws sqs create-queue --queue-name [value]Creates a new queue.
aws sqs get-queue-url --queue-name [value]Gets the URL of a queue.
aws sqs send-message --queue-url [value] --message-body [value]Sends a message to a queue.
aws sqs receive-message --queue-url [value]Receives one or more messages from a queue.
aws sqs delete-message --queue-url [value] --receipt-handle [value]Deletes a message from a queue.
aws sqs purge-queue --queue-url [value]Deletes all messages in a queue.
aws sqs delete-queue --queue-url [value]Deletes a queue.

CommandDescription
aws sns create-topic --name [topic-name]Create a new SNS topic.
aws sns list-topicsList all SNS topics.
aws sns delete-topic --topic-arn [topic-arn]Delete a topic.
aws sns subscribe --topic-arn [topic-arn] --protocol [protocol] --notification-endpoint [endpoint]Create a subscription.
aws sns confirm-subscription --topic-arn [topic-arn] --token [token]Confirm a subscription.
aws sns list-subscriptions-by-topic --topic-arn [topic-arn]List subscriptions for a topic.
aws sns unsubscribe --subscription-arn [subscription-arn]Remove a subscription.
aws sns publish --topic-arn [topic-arn] --message [message]Publish a message to a topic.
aws sns publish --phone-number [phone-number] --message [message]Send an SMS message directly.

Additional Information

  • Use aws configure to set up your credentials and default region.
  • Add --output json or --output text to format the output.
  • Use --query to filter results with JMESPath expressions.
  • Most commands support a --dry-run flag to simulate the command without actually running it.

  • Filtering Output: Use --filter (server-side) or --query (client-side with JMESPath) to refine results.
  • JMESPath: A powerful query language for JSON output. Learn more at https://jmespath.org/tutorial.html.
  • Configuration and Profiles: Manage multiple AWS accounts or roles using named profiles in ~/.aws/config and ~/.aws/credentials.
  • Automation and Scripting: The AWS CLI is excellent for automating tasks and can be integrated into scripts.
  • Command Completion: Enable tab completion for faster command-line usage.
  • Dry Run: Use --dry-run to simulate commands without execution.
  • Session Manager: Start interactive sessions on EC2 instances without SSH.
  • Aliases: Create aliases for frequently used commands.
  • Standard Input/Output Redirection: Use - to pipe data.

  • Principle of Least Privilege: Grant only necessary permissions.
  • IAM Roles: Use temporary permissions instead of long-term access keys.
  • Multi-Factor Authentication (MFA): Enforce MFA for privileged access.
  • IAM Identity Center: Use for temporary CLI access.
  • Avoid Hardcoding Credentials: Never hardcode access keys.
  • Secure Storage: Store credentials in AWS Secrets Manager or secure files.
  • Rotate Credentials Regularly: Rotate access keys to reduce risk.
  • AWS CloudTrail: Log all API calls for auditing.
  • VPC Flow Logs: Monitor network traffic.
  • Amazon GuardDuty: Enable for threat detection.
  • Encryption: Encrypt sensitive data at rest and in transit.
  • Enforce Minimum TLS Version: Configure TLS for communication.
  • Security Groups and Network ACLs: Control network traffic.
  • VPC Endpoints: Securely connect to AWS services within your VPC.