AWS CLI Cheat Sheet

Authenticate, query, and manage AWS resources — IAM, S3, EC2, ECR, EKS, CloudWatch, secrets, and SSM.

Cloud6 sections · 46 commands
⌘K

Auth & Config

9
aws configure

Set access key + region (profile)

aws configure --profile PROD

Configure a separate profile

aws sts get-caller-identity

Who am I / which account

aws configure list-profiles

List configured profiles

export AWS_PROFILE=prod

Pick a profile via env

aws --region us-east-1 ec2 describe-instances

Override region per command

aws sso login --profile dev

SSO-based login

aws configure get aws_access_key_id

Introduce current credentials (no echo)

aws configservice describe-compliance-by-resource

Check config compliance

S3

11
aws s3 ls

List buckets

aws s3 ls s3://BUCKET --recursive

List objects recursively

aws s3 cp FILE s3://BUCKET/file

Upload a file

aws s3 cp s3://BUCKET/file .

Download a file

aws s3 sync DIR s3://BUCKET

Two-way byte-differencing sync

aws s3 sync s3://BUCKET DIR

Download sync

aws s3 mb s3://BUCKET

Create a bucket

aws s3 rb s3://BUCKET --force

Remove a bucket (force empty)

aws s3 rm s3://BUCKET/key

Delete an object

aws s3 ls s3://BUCKET --human-readable --summarize

Folder size summary

aws s3 presign s3://BUCKET/file --expires-in 3600

Temp public URL

EC2

9
aws ec2 describe-instances

Instances with state

aws ec2 describe-instances --query 'Reservations[].Instances[].{Id:InstanceId,State:State.Name}' --output table

Compact table view

aws ec2 describe-instances --filters Name=tag:Name,Values=web

Filter by tag

aws ec2 start-instances --instance-ids i-123

Start instances

aws ec2 stop-instances --instance-ids i-123

Stop instances

aws ec2 terminate-instances --instance-ids i-123

Terminate instances (irreversible)

aws ec2 run-instances --image-id ami-123 --instance-type t3.micro --key-name KEY

Launch an instance

aws ec2 describe-availability-zones

AZs in the region

aws ec2 create-tags --resources i-123 --tags Key=Name,Value=web

Tag a resource

ECS & EKS

5
aws ecr get-login-password --region REGION | docker login --username AWS --password-stdin ACCOUNT.dkr.ecr.REGION.amazonaws.com

Authenticate Docker to ECR

aws ecs list-services --cluster CLUSTER

Running ECS services

aws ecs update-service --cluster C --service S --force-new-deployment

Trigger a redeploy

aws eks update-kubeconfig --name CLUSTER

Load a cluster into kubeconfig

aws eks list-clusters

EKS clusters in the account

CloudWatch, SSM & Secrets

7
aws logs tail /aws/lambda/FN --follow

Stream a log group live

aws logs get-log-events --log-group-name G --log-stream-name S

Read specific events

aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name CPUUtilization --period 300 --statistics Average

Query a metric

aws ssm start-session --target i-123

SSM session (no SSH needed)

aws ssm send-command --instance-ids i-123 --document-name AWS-RunShellScript --parameters commands=uptime

Run a command on many hosts

aws secretsmanager get-secret-value --secret-id NAME --query SecretString --output text

Fetch a secret

aws iam list-attached-user-policies --user-name U

What policies a user has

IAM & Permissions

5
aws iam get-user

Current user details

aws iam list-users

All IAM users

aws iam attach-user-policy --user-name U --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Attach a managed policy

aws sts assume-role --role-arn ARN --role-session-name sess

Assume a role

aws iam create-access-key --user-name U

Create an access key