Overview
Commands target AWS CLI v2. Run aws sts get-caller-identity first to confirm which credentials are active. Region precedence is --region, then AWS_REGION, then AWS_DEFAULT_REGION, then the profile; --profile <name> or AWS_PROFILE selects a profile. For CI credentials see github-secrets; for JSON post-processing see jq-syntax.
S3
Preview with --dryrun before any sync or rm --recursive.
| Command | Effect |
|---|---|
aws s3 ls s3://bucket/prefix/ | List objects (aws s3 ls lists buckets). |
aws s3 cp f.txt s3://bucket/f.txt | Upload (swap the arguments to download). |
aws s3 sync ./dist s3://bucket/ --dryrun | Preview a sync; drop --dryrun to run it. |
aws s3 sync ./dist s3://bucket/ --delete | Also delete destination objects absent from the source. |
aws s3 rm s3://bucket/prefix/ --recursive | Delete everything under a prefix. |
aws s3 presign s3://bucket/f.txt --expires-in 3600 | Temporary download URL. |
aws s3 mb s3://new-bucket / aws s3 rb s3://old-bucket | Create / delete an empty bucket. |
# Static site: long cache for assets, no cache for the entry page
aws s3 sync dist s3://bucket/ --delete --cache-control "max-age=31536000,public" --exclude "index.html"
aws s3 cp dist/index.html s3://bucket/index.html --cache-control "no-cache"EC2
Filter with --query instead of parsing text output.
| Command | Effect |
|---|---|
aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,State.Name,PublicIpAddress]' --output table | Compact instance list. |
aws ec2 start-instances --instance-ids i-0abc123 | Start (also stop-instances, terminate-instances). |
aws ec2 describe-security-groups --group-ids sg-0abc | Inspect rules. |
aws ec2 describe-images --owners self | Your AMIs. |
Lambda and logs
CLI v2 treats --payload as base64 unless you set the binary format, so pass it with raw JSON.
| Command | Effect |
|---|---|
aws lambda invoke --function-name fn --cli-binary-format raw-in-base64-out --payload '{"a":1}' out.json | Synchronous call; response in out.json. |
aws lambda invoke ... --invocation-type Event ... | Async call; returns 202 whether or not the function later fails. |
aws lambda update-function-code --function-name fn --zip-file fileb://fn.zip | Deploy a zip (fileb:// reads binary). |
aws lambda update-function-configuration --function-name fn --timeout 30 | Change memory, timeout, env vars. |
aws lambda list-functions, aws lambda get-function-configuration --function-name fn | List functions / read one’s settings. |
aws logs tail /aws/lambda/fn --follow | Stream CloudWatch logs. |
Set the format once: aws configure set cli_binary_format raw-in-base64-out.
STS and IAM
Use temporary role credentials and avoid long-lived access keys.
| Command | Effect |
|---|---|
aws sts get-caller-identity | Account, ARN, and user ID of the active credentials. |
aws sts assume-role --role-arn <arn> --role-session-name s1 | Temporary credentials for a role. |
aws iam list-attached-user-policies --user-name alice | Policies attached to a user. |
aws iam get-role --role-name MyRole | Trust policy and ARN. |
aws iam list-users, aws iam list-roles | Enumerate principals. |
aws iam simulate-principal-policy --policy-source-arn <arn> --action-names s3:PutObject | Test whether a principal may act. |
Prefer a profile with role_arn and source_profile in ~/.aws/config over exporting assumed-role keys by hand, and aws configure sso over long-lived access keys.
Gotchas
Check these when a command fails or hangs in a script.
| Gotcha | Fix |
|---|---|
s3 sync leaves stale objects in the destination. | Add --delete, and preview with --dryrun. |
| v2 sends output through a pager and stalls scripts. | export AWS_PAGER="" or --no-cli-pager. |
lambda invoke --payload '{}' fails with an invalid base64 error. | Add --cli-binary-format raw-in-base64-out. |
--output table is for people; --output json is for scripts. | Filter with --query (JMESPath) before assigning to variables. |
| A CI default region can differ from your laptop. | Set AWS_REGION or pass --region explicitly. |
| Access denied on every call. | Run aws sts get-caller-identity to see who you are. |