AWS CLI Cheat Sheet
A quick reference for common AWS CLI commands.
| Command | Description |
|---|---|
aws s3 ls | List all S3 buckets. |
aws s3 ls s3://[bucket-name] | List objects in a bucket. |
aws s3 mb s3://[bucket-name] | Create an S3 bucket. |
aws s3 rb s3://[bucket-name] | Delete an S3 bucket. |
aws s3 cp [file] s3://[bucket-name] | Copy a file to an S3 bucket. |
aws s3 cp s3://[bucket-name]/[file] [destination] | Copy a file from an S3 bucket. |
aws s3 mv [file] s3://[bucket-name] | Move a file to an S3 bucket. |
aws s3 rm s3://[bucket-name]/[file] | Delete a file from an S3 bucket. |
aws s3 sync [folder] s3://[bucket-name] | Sync a folder with an S3 bucket. |
aws s3 presign s3://[bucket-name]/[file] | Generate a presigned URL for a file. |
| Command | Description |
|---|---|
aws ec2 describe-instances | Describe all EC2 instances. |
aws ec2 run-instances --image-id [ami-id] --instance-type [type] --key-name [key-name] | Launch an EC2 instance. |
aws ec2 start-instances --instance-ids [instance-id] | Start an EC2 instance. |
aws ec2 stop-instances --instance-ids [instance-id] | Stop an EC2 instance. |
aws ec2 reboot-instances --instance-ids [instance-id] | Reboot an EC2 instance. |
aws ec2 terminate-instances --instance-ids [instance-id] | Terminate an EC2 instance. |
aws ec2 describe-vpcs | Describe all VPCs. |
aws ec2 describe-subnets | Describe all subnets. |
aws ec2 describe-security-groups | Describe all security groups. |
aws ec2 create-key-pair --key-name [key-name] | Create a new EC2 key pair. |
| Command | Description |
|---|---|
aws iam list-users | List all IAM users. |
aws iam create-user --user-name [username] | Create a new IAM user. |
aws iam delete-user --user-name [username] | Delete an IAM user. |
aws iam list-roles | List all IAM roles. |
aws iam create-role --role-name [rolename] --assume-role-policy-document file://[policy.json] | Create a new IAM role. |
aws iam attach-role-policy --role-name [rolename] --policy-arn [policy-arn] | Attach a policy to an IAM role. |
aws iam list-policies | List all IAM policies. |
| Command | Description |
|---|---|
aws lambda list-functions | List all Lambda functions. |
aws lambda invoke --function-name [function-name] [output-file] | Invoke a Lambda function. |
aws lambda create-function --function-name [name] --runtime [runtime] --role [role-arn] --handler [handler] --zip-file fileb://[package.zip] | Create a new Lambda function. |
aws lambda delete-function --function-name [function-name] | Delete a Lambda function. |
aws lambda get-function-configuration --function-name [function-name] | Get configuration for a Lambda function. |
| Command | Description |
|---|---|
aws cloudformation create-stack --stack-name [name] --template-body file://[template.yaml] | Create a new CloudFormation stack. |
aws cloudformation update-stack --stack-name [name] --template-body file://[template.yaml] | Update an existing CloudFormation stack. |
aws cloudformation delete-stack --stack-name [name] | Delete a CloudFormation stack. |
aws cloudformation describe-stacks --stack-name [name] | Describe a CloudFormation stack. |
aws cloudformation validate-template --template-body file://[template.yaml] | Validate a CloudFormation template. |
| Command | Description |
|---|---|
aws logs describe-log-groups | List all log groups. |
aws logs describe-log-streams --log-group-name [log-group-name] | List log streams in a log group. |
aws logs get-log-events --log-group-name [log-group-name] --log-stream-name [log-stream-name] | Get log events from a log stream. |
aws logs tail [log-group-name] | Tail log events in real-time. |
| Command | Description |
|---|---|
aws sqs list-queues | Lists all your SQS queues. |
aws sqs create-queue --queue-name [value] | Creates a new queue. |
aws sqs get-queue-url --queue-name [value] | Gets the URL of a queue. |
aws sqs send-message --queue-url [value] --message-body [value] | Sends a message to a queue. |
aws sqs receive-message --queue-url [value] | Receives one or more messages from a queue. |
aws sqs delete-message --queue-url [value] --receipt-handle [value] | Deletes a message from a queue. |
aws sqs purge-queue --queue-url [value] | Deletes all messages in a queue. |
aws sqs delete-queue --queue-url [value] | Deletes a queue. |
| Command | Description |
|---|---|
aws sns create-topic --name [topic-name] | Create a new SNS topic. |
aws sns list-topics | List all SNS topics. |
aws sns delete-topic --topic-arn [topic-arn] | Delete a topic. |
aws sns subscribe --topic-arn [topic-arn] --protocol [protocol] --notification-endpoint [endpoint] | Create a subscription. |
aws sns confirm-subscription --topic-arn [topic-arn] --token [token] | Confirm a subscription. |
aws sns list-subscriptions-by-topic --topic-arn [topic-arn] | List subscriptions for a topic. |
aws sns unsubscribe --subscription-arn [subscription-arn] | Remove a subscription. |
aws sns publish --topic-arn [topic-arn] --message [message] | Publish a message to a topic. |
aws sns publish --phone-number [phone-number] --message [message] | Send an SMS message directly. |
Additional Information
- Use
aws configureto set up your credentials and default region. - Add
--output jsonor--output textto format the output. - Use
--queryto filter results with JMESPath expressions. - Most commands support a
--dry-runflag to simulate the command without actually running it.
- Filtering Output: Use
--filter(server-side) or--query(client-side with JMESPath) to refine results. - JMESPath: A powerful query language for JSON output. Learn more at https://jmespath.org/tutorial.html.
- Configuration and Profiles: Manage multiple AWS accounts or roles using named profiles in
~/.aws/configand~/.aws/credentials. - Automation and Scripting: The AWS CLI is excellent for automating tasks and can be integrated into scripts.
- Command Completion: Enable tab completion for faster command-line usage.
- Dry Run: Use
--dry-runto simulate commands without execution. - Session Manager: Start interactive sessions on EC2 instances without SSH.
- Aliases: Create aliases for frequently used commands.
- Standard Input/Output Redirection: Use
-to pipe data.
- Principle of Least Privilege: Grant only necessary permissions.
- IAM Roles: Use temporary permissions instead of long-term access keys.
- Multi-Factor Authentication (MFA): Enforce MFA for privileged access.
- IAM Identity Center: Use for temporary CLI access.
- Avoid Hardcoding Credentials: Never hardcode access keys.
- Secure Storage: Store credentials in AWS Secrets Manager or secure files.
- Rotate Credentials Regularly: Rotate access keys to reduce risk.
- AWS CloudTrail: Log all API calls for auditing.
- VPC Flow Logs: Monitor network traffic.
- Amazon GuardDuty: Enable for threat detection.
- Encryption: Encrypt sensitive data at rest and in transit.
- Enforce Minimum TLS Version: Configure TLS for communication.
- Security Groups and Network ACLs: Control network traffic.
- VPC Endpoints: Securely connect to AWS services within your VPC.