AWS CLI Commands Cheatsheet

Overview

The AWS CLI (aws) is the standard tool for scripting AWS from the terminal or CI. This card groups commands by service. All examples assume AWS CLI v2 and a configured profile (aws configure or environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION). Add --profile <name> to any command to use a non-default profile. For secrets storage in CI, see github-secrets.

S3 commands

Command	What it does
aws s3 ls	List all buckets.
aws s3 ls s3://my-bucket/prefix/	List objects under a prefix.
aws s3 cp file.txt s3://my-bucket/file.txt	Upload a single file.
aws s3 cp s3://my-bucket/file.txt ./file.txt	Download a single file.
aws s3 sync ./dist s3://my-bucket/	Sync a directory; skips unchanged files.
aws s3 sync s3://my-bucket/ ./backup	Download bucket to local directory.
aws s3 rm s3://my-bucket/file.txt	Delete a single object.
aws s3 rm s3://my-bucket/prefix/ --recursive	Delete all objects under a prefix.
aws s3 mb s3://new-bucket --region us-east-1	Create a bucket.
aws s3 rb s3://empty-bucket	Delete an empty bucket.
aws s3 presign s3://my-bucket/file.txt --expires-in 3600	Generate a pre-signed URL valid for 1 hour.

# Sync with cache headers for static site deployment
aws s3 sync ./dist s3://my-bucket/ \
  --delete \
  --cache-control "max-age=31536000,public" \
  --exclude "index.html" \
  --exclude "*.json"
 
# Upload index.html with no-cache
aws s3 cp ./dist/index.html s3://my-bucket/index.html \
  --cache-control "no-cache,no-store"

EC2 commands

Command	What it does
aws ec2 describe-instances	List all instances with full detail.
aws ec2 describe-instances --query "Reservations[*].Instances[*].[InstanceId,State.Name,PublicIpAddress]" --output table	Terse table of ID, state, IP.
aws ec2 start-instances --instance-ids i-0abc123	Start a stopped instance.
aws ec2 stop-instances --instance-ids i-0abc123	Stop a running instance.
aws ec2 terminate-instances --instance-ids i-0abc123	Terminate (delete) an instance.
aws ec2 describe-security-groups --group-ids sg-0abc	Inspect a security group’s rules.
aws ec2 describe-key-pairs	List SSH key pairs registered in EC2.
aws ec2 describe-images --owners self	List your custom AMIs.

# Terse instance summary across all states
aws ec2 describe-instances \
  --query "Reservations[*].Instances[*].{ID:InstanceId,State:State.Name,IP:PublicIpAddress,Name:Tags[?Key=='Name']|[0].Value}" \
  --output table

Lambda commands

Command	What it does
aws lambda list-functions	List all Lambda functions in the region.
aws lambda get-function --function-name my-fn	Function config and download URL.
aws lambda invoke --function-name my-fn --payload '{}' out.json	Invoke synchronously; response body goes to out.json.
aws lambda invoke --function-name my-fn --invocation-type Event --payload '{}' /dev/null	Async invoke; no response body.
aws lambda update-function-code --function-name my-fn --zip-file fileb://fn.zip	Deploy new code from a zip.
aws lambda update-function-configuration --function-name my-fn --timeout 30	Change a configuration parameter.
aws lambda get-function-configuration --function-name my-fn	Read current memory, timeout, env vars.
aws logs tail /aws/lambda/my-fn --follow	Stream live Lambda logs (CloudWatch).

# Invoke with a JSON payload from a file
aws lambda invoke \
  --function-name my-fn \
  --payload file://event.json \
  --log-type Tail \
  --query 'LogResult' \
  --output text \
  out.json | base64 --decode

STS commands

Use STS to check your identity and assume roles.

Command	What it does
aws sts get-caller-identity	Show the current account ID, user/role ARN, and user ID.
aws sts assume-role --role-arn arn:aws:iam::123:role/MyRole --role-session-name session1	Assume a cross-account or privileged role; returns temporary credentials.
aws sts get-session-token --duration-seconds 3600	Get temporary credentials for an IAM user; used with MFA.

# Assume a role and export credentials to the shell
eval $(aws sts assume-role \
  --role-arn arn:aws:iam::123456789:role/DeployRole \
  --role-session-name deploy \
  --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
  --output text \
  | awk '{print "export AWS_ACCESS_KEY_ID="$1" AWS_SECRET_ACCESS_KEY="$2" AWS_SESSION_TOKEN="$3}')

IAM commands

Command	What it does
aws iam list-users	List all IAM users.
aws iam get-user --user-name alice	User details and ARN.
aws iam list-attached-user-policies --user-name alice	Policies directly attached to a user.
aws iam list-roles	List all IAM roles.
aws iam get-role --role-name MyRole	Role trust policy and ARN.
aws iam simulate-principal-policy --policy-source-arn arn --action-names s3:PutObject --resource-arns arn:aws:s3:::bucket/*	Simulate whether an ARN can perform an action.
aws iam create-policy --policy-name MyPolicy --policy-document file://policy.json	Create a managed policy from a file.

Common gotchas

• aws s3 sync does not delete by default. Add --delete to remove objects in the destination that are absent from the source. Without it, old files accumulate.
• --output table is for humans; --output json is for scripts. Use --query with JMESPath to filter before assigning to variables.
• Lambda --payload in CLI v2 requires JSON as a string or file://path. Plain '{}' works in bash; quote carefully in CI environments.
• aws sts get-caller-identity is the fastest way to confirm which credentials are active. Run it first when commands fail with access denied.
• aws lambda invoke with --invocation-type Event always returns HTTP 202, even if the function fails. Check CloudWatch logs to diagnose async failures.
• Region is required for most services. Set AWS_DEFAULT_REGION or --region on each command; the config file default can be wrong in CI.

Related

• cloudflare-r2
• vercel
• github-secrets
• github-actions
• curl-flags
• bash-one-liners
• Cheatsheets