AWS

AWS CLI Commands Cheat Sheet

Practical AWS CLI commands for EC2, S3, IAM, VPC, ECR, ECS, EKS, Lambda, RDS, CloudWatch, Route 53, Systems Manager, security, troubleshooting and CI/CD automation.

33 categories178+ commands

Showing 178 commands.

AWS CLI Setup and Configuration

aws --version

Display the installed AWS CLI version.

aws configure

Configure the default AWS access key, secret key, region and output format.

aws configure list

Show the credentials, profile and region currently being used.

aws configure get region

Display the configured default AWS region.

aws configure set region ap-south-1

Set the default AWS region to Mumbai (ap-south-1).

aws configure list-profiles

List all configured AWS CLI profiles.

aws sts get-caller-identity

Show the AWS account, user or role associated with the current credentials.

aws sts get-caller-identity --profile dev

Check the AWS identity associated with a specific profile.

aws help

Display general AWS CLI help.

aws ec2 help

Display help for the EC2 service.

AWS Profiles and Regions

aws s3 ls --profile dev

Run an AWS command using a specific CLI profile.

aws ec2 describe-instances --region ap-south-1

Run an EC2 command against a specific AWS region.

aws ec2 describe-regions

List AWS regions available to the account.

aws ec2 describe-availability-zones --region ap-south-1

List Availability Zones in the selected region.

EC2 Instances

aws ec2 describe-instances

List and inspect EC2 instances.

aws ec2 describe-instances --instance-ids i-0123456789abcdef0

Retrieve information about a specific EC2 instance.

aws ec2 describe-instances --filters Name=instance-state-name,Values=running

List only EC2 instances that are currently running.

aws ec2 describe-instances --filters Name=instance-state-name,Values=stopped

List stopped EC2 instances.

aws ec2 start-instances --instance-ids i-0123456789abcdef0

Start a stopped EC2 instance.

aws ec2 stop-instances --instance-ids i-0123456789abcdef0

Stop a running EC2 instance.

aws ec2 reboot-instances --instance-ids i-0123456789abcdef0

Reboot an EC2 instance.

aws ec2 terminate-instances --instance-ids i-0123456789abcdef0

Terminate an EC2 instance.

aws ec2 describe-instance-status --instance-ids i-0123456789abcdef0

Check EC2 system and instance status checks.

EC2 AMIs and Snapshots

aws ec2 describe-images --owners self

List AMIs owned by the current AWS account.

aws ec2 describe-images --owners amazon

List Amazon-owned AMIs visible to the account.

aws ec2 create-image --instance-id i-0123456789abcdef0 --name my-server-ami

Create an AMI from an EC2 instance.

aws ec2 deregister-image --image-id ami-0123456789abcdef0

Deregister an AMI.

aws ec2 describe-snapshots --owner-ids self

List EBS snapshots owned by the current account.

aws ec2 create-snapshot --volume-id vol-0123456789abcdef0 --description "Application backup"

Create an EBS snapshot from a volume.

aws ec2 delete-snapshot --snapshot-id snap-0123456789abcdef0

Delete an EBS snapshot.

EC2 Key Pairs

aws ec2 describe-key-pairs

List EC2 key pairs.

aws ec2 describe-key-pairs --key-names my-key

Display information about a specific key pair.

aws ec2 create-key-pair --key-name my-key

Create an EC2 key pair and return the private key material.

aws ec2 delete-key-pair --key-name my-key

Delete an EC2 key pair from AWS.

EC2 Security Groups

aws ec2 describe-security-groups

List EC2 security groups.

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

Display the rules and configuration of a specific security group.

aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 22 --cidr 203.0.113.10/32

Add an inbound TCP rule to a security group.

aws ec2 revoke-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 22 --cidr 203.0.113.10/32

Remove an inbound security group rule.

aws ec2 authorize-security-group-egress --group-id sg-0123456789abcdef0 --protocol tcp --port 443 --cidr 0.0.0.0/0

Add an outbound TCP rule to a security group.

EBS Volumes

aws ec2 describe-volumes

List EBS volumes.

aws ec2 describe-volumes --volume-ids vol-0123456789abcdef0

Display details about a specific EBS volume.

aws ec2 create-volume --availability-zone ap-south-1a --size 20 --volume-type gp3

Create a 20 GiB gp3 EBS volume.

aws ec2 modify-volume --volume-id vol-0123456789abcdef0 --size 40

Modify the size of an EBS volume.

aws ec2 delete-volume --volume-id vol-0123456789abcdef0

Delete an EBS volume that is no longer required.

Elastic IP Addresses

aws ec2 describe-addresses

List Elastic IP addresses allocated to the account.

aws ec2 allocate-address --domain vpc

Allocate a new Elastic IP address for use with a VPC.

aws ec2 associate-address --instance-id i-0123456789abcdef0 --allocation-id eipalloc-0123456789abcdef0

Associate an Elastic IP address with an EC2 instance.

aws ec2 release-address --allocation-id eipalloc-0123456789abcdef0

Release an Elastic IP address.

S3 Buckets

aws s3 ls

List S3 buckets.

aws s3 ls s3://my-bucket

List objects in an S3 bucket.

aws s3 mb s3://my-bucket

Create an S3 bucket.

aws s3 rb s3://my-bucket

Remove an empty S3 bucket.

aws s3 rb s3://my-bucket --force

Remove an S3 bucket and its objects. Use with caution.

aws s3api get-bucket-location --bucket my-bucket

Check the AWS region associated with an S3 bucket.

aws s3api get-bucket-versioning --bucket my-bucket

Check whether S3 versioning is enabled.

S3 Files and Sync

aws s3 cp file.txt s3://my-bucket/

Upload a local file to S3.

aws s3 cp s3://my-bucket/file.txt .

Download an object from S3.

aws s3 cp ./app s3://my-bucket/app --recursive

Upload a directory and its contents to S3.

aws s3 sync ./build s3://my-bucket/build

Synchronize a local directory with an S3 prefix.

aws s3 sync s3://my-bucket/build ./build

Synchronize an S3 prefix with a local directory.

aws s3 rm s3://my-bucket/file.txt

Delete an S3 object.

aws s3 rm s3://my-bucket/logs/ --recursive

Delete objects under an S3 prefix.

aws s3 cp file.txt s3://my-bucket/ --storage-class STANDARD_IA

Upload an object using a specified S3 storage class.

IAM Users and Roles

aws iam list-users

List IAM users.

aws iam get-user

Retrieve information about the current IAM user when applicable.

aws iam list-roles

List IAM roles.

aws iam get-role --role-name MyRole

Display information about an IAM role.

aws iam list-attached-role-policies --role-name MyRole

List managed policies attached to an IAM role.

aws iam list-role-policies --role-name MyRole

List inline policies attached to an IAM role.

aws iam list-attached-user-policies --user-name my-user

List managed policies attached to an IAM user.

IAM Policies

aws iam list-policies

List IAM policies visible to the account.

aws iam get-policy --policy-arn arn:aws:iam::123456789012:policy/MyPolicy

Retrieve metadata about an IAM policy.

aws iam list-policy-versions --policy-arn arn:aws:iam::123456789012:policy/MyPolicy

List versions of an IAM managed policy.

aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/MyPolicy --version-id v1

Retrieve the document for a specific IAM policy version.

aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:role/MyRole --action-names s3:GetObject --resource-arns arn:aws:s3:::my-bucket/*

Simulate whether a principal is allowed to perform a specific action.

IAM Access Keys

aws iam list-access-keys --user-name my-user

List access keys associated with an IAM user.

aws iam create-access-key --user-name my-user

Create an access key for an IAM user. Handle credentials securely.

aws iam update-access-key --user-name my-user --access-key-id AKIAEXAMPLE --status Inactive

Deactivate an IAM access key.

aws iam delete-access-key --user-name my-user --access-key-id AKIAEXAMPLE

Delete an IAM access key.

VPC and Networking

aws ec2 describe-vpcs

List VPCs.

aws ec2 describe-subnets

List VPC subnets.

aws ec2 describe-route-tables

List route tables.

aws ec2 describe-internet-gateways

List Internet Gateways.

aws ec2 describe-nat-gateways

List NAT Gateways.

aws ec2 describe-network-interfaces

List Elastic Network Interfaces.

aws ec2 describe-network-acls

List network ACLs configured in the VPC.

Elastic Load Balancing

aws elbv2 describe-load-balancers

List Application Load Balancers and Network Load Balancers.

aws elbv2 describe-target-groups

List Elastic Load Balancing target groups.

aws elbv2 describe-target-health --target-group-arn TARGET_GROUP_ARN

Check the health of targets registered with a target group.

aws elbv2 describe-listeners --load-balancer-arn LOAD_BALANCER_ARN

List listeners configured on a load balancer.

Auto Scaling

aws autoscaling describe-auto-scaling-groups

List Auto Scaling groups.

aws autoscaling describe-auto-scaling-instances

List instances managed by Auto Scaling.

aws autoscaling set-desired-capacity --auto-scaling-group-name my-asg --desired-capacity 3

Set the desired capacity of an Auto Scaling group.

aws autoscaling update-auto-scaling-group --auto-scaling-group-name my-asg --min-size 2 --max-size 5

Update the minimum and maximum capacity of an Auto Scaling group.

ECR

aws ecr describe-repositories

List Amazon ECR repositories.

aws ecr create-repository --repository-name myapp

Create an ECR repository.

aws ecr get-login-password --region ap-south-1

Generate a temporary authentication password for an ECR registry.

aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com

Authenticate Docker with an Amazon ECR registry.

aws ecr list-images --repository-name myapp

List images stored in an ECR repository.

aws ecr describe-images --repository-name myapp

Display metadata about images stored in ECR.

aws ecr batch-delete-image --repository-name myapp --image-ids imageTag=latest

Delete an image from an ECR repository.

ECS

aws ecs list-clusters

List ECS clusters.

aws ecs describe-clusters --clusters my-cluster

Display information about an ECS cluster.

aws ecs list-services --cluster my-cluster

List services running in an ECS cluster.

aws ecs describe-services --cluster my-cluster --services my-service

Display ECS service configuration and deployment information.

aws ecs list-tasks --cluster my-cluster

List running or stopped ECS tasks.

aws ecs describe-tasks --cluster my-cluster --tasks TASK_ARN

Display detailed information about an ECS task.

aws ecs update-service --cluster my-cluster --service my-service --force-new-deployment

Force a new ECS service deployment using the current task definition.

EKS

aws eks list-clusters

List EKS clusters.

aws eks describe-cluster --name my-cluster

Display configuration and status information for an EKS cluster.

aws eks list-nodegroups --cluster-name my-cluster

List managed node groups in an EKS cluster.

aws eks describe-nodegroup --cluster-name my-cluster --nodegroup-name my-nodegroup

Display information about an EKS managed node group.

aws eks update-kubeconfig --region ap-south-1 --name my-cluster

Configure kubectl to connect to an EKS cluster.

aws eks update-kubeconfig --region ap-south-1 --name my-cluster --alias production-eks

Add an EKS cluster to kubeconfig using a custom context alias.

Lambda

aws lambda list-functions

List Lambda functions.

aws lambda get-function --function-name my-function

Retrieve Lambda function configuration and deployment information.

aws lambda invoke --function-name my-function response.json

Invoke a Lambda function and save the response.

aws lambda update-function-code --function-name my-function --zip-file fileb://function.zip

Update Lambda function code from a ZIP package.

aws lambda publish-version --function-name my-function

Publish a new immutable version of a Lambda function.

aws lambda list-versions-by-function --function-name my-function

List published versions of a Lambda function.

aws lambda delete-function --function-name my-function

Delete a Lambda function.

RDS

aws rds describe-db-instances

List RDS database instances.

aws rds describe-db-instances --db-instance-identifier mydb

Display details about a specific RDS database instance.

aws rds describe-db-clusters

List RDS database clusters.

aws rds reboot-db-instance --db-instance-identifier mydb

Reboot an RDS database instance.

aws rds stop-db-instance --db-instance-identifier mydb

Stop an RDS database instance when supported by its configuration.

aws rds create-db-snapshot --db-instance-identifier mydb --db-snapshot-identifier mydb-backup

Create a manual RDS database snapshot.

aws rds describe-db-snapshots --db-instance-identifier mydb

List snapshots associated with an RDS instance.

CloudWatch Metrics

aws cloudwatch list-metrics

List CloudWatch metrics.

aws cloudwatch list-metrics --namespace AWS/EC2

List metrics from the EC2 CloudWatch namespace.

aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name CPUUtilization --dimensions Name=InstanceId,Value=i-0123456789abcdef0 --statistics Average --period 300 --start-time 2026-09-20T10:00:00Z --end-time 2026-09-20T11:00:00Z

Retrieve historical CPU utilization statistics for an EC2 instance.

aws cloudwatch describe-alarms

List CloudWatch alarms.

aws cloudwatch describe-alarms-for-metric --metric-name CPUUtilization --namespace AWS/EC2 --dimensions Name=InstanceId,Value=i-0123456789abcdef0

Find alarms associated with a specific CloudWatch metric.

CloudWatch Logs

aws logs describe-log-groups

List CloudWatch Logs log groups.

aws logs describe-log-streams --log-group-name /aws/lambda/my-function

List log streams in a CloudWatch log group.

aws logs tail /aws/lambda/my-function --follow

Stream recent CloudWatch log events from a log group.

aws logs tail /aws/lambda/my-function --since 1h

Display recent CloudWatch log events from the previous hour.

Route 53

aws route53 list-hosted-zones

List Route 53 hosted zones.

aws route53 list-resource-record-sets --hosted-zone-id Z123456789

List DNS records in a hosted zone.

aws route53 list-health-checks

List Route 53 health checks.

aws route53 get-health-check-status --health-check-id HEALTH_CHECK_ID

Check the status of a Route 53 health check.

Systems Manager

aws ssm describe-instance-information

List managed instances registered with Systems Manager.

aws ssm send-command --instance-ids i-0123456789abcdef0 --document-name AWS-RunShellScript --parameters commands='uname -a'

Execute a shell command remotely through Systems Manager.

aws ssm list-command-invocations

List Systems Manager command invocations.

aws ssm get-command-invocation --command-id COMMAND_ID --instance-id i-0123456789abcdef0

Retrieve the output and status of a Systems Manager command.

aws ssm start-session --target i-0123456789abcdef0

Start an interactive Systems Manager session with a managed EC2 instance.

Secrets Manager

aws secretsmanager list-secrets

List secrets available to the current AWS identity.

aws secretsmanager describe-secret --secret-id my-secret

Display metadata about a secret.

aws secretsmanager get-secret-value --secret-id my-secret

Retrieve the current value of a secret when permitted.

CloudFormation

aws cloudformation list-stacks

List CloudFormation stacks.

aws cloudformation describe-stacks --stack-name my-stack

Display CloudFormation stack details.

aws cloudformation describe-stack-events --stack-name my-stack

Display stack events useful for troubleshooting deployments.

aws cloudformation describe-stack-resources --stack-name my-stack

List resources created by a CloudFormation stack.

CloudTrail

aws cloudtrail describe-trails

List CloudTrail trails.

aws cloudtrail get-trail-status --name my-trail

Check the current status of a CloudTrail trail.

aws cloudtrail lookup-events --max-results 50

Search recent CloudTrail events.

AWS Resource Tagging

aws resourcegroupstaggingapi get-resources

List tagged resources available through the Resource Groups Tagging API.

aws resourcegroupstaggingapi get-resources --tag-filters Key=Environment,Values=production

Find resources using a specific tag filter.

AWS Cost and Usage

aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY --metrics UnblendedCost

Retrieve cost and usage data for a specified time period.

aws budgets describe-budgets --account-id 123456789012

List AWS Budgets configured for an account.

Useful JSON and Output Options

aws ec2 describe-instances --output json

Return AWS CLI output as JSON.

aws ec2 describe-instances --output table

Display AWS CLI output in a table.

aws ec2 describe-instances --output text

Return AWS CLI output as tab-separated text.

aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId'

Use JMESPath to extract specific fields from AWS CLI output.

aws ec2 describe-instances --query 'Reservations[].Instances[].{ID:InstanceId,State:State.Name}' --output table

Extract selected EC2 fields and display them as a table.

AWS CLI Troubleshooting

aws sts get-caller-identity

Verify which AWS identity is currently being used.

aws configure list

Check which credentials, region and profile configuration are active.

aws ec2 describe-instances --region ap-south-1

Check whether a resource is being searched in the expected region.

aws s3 ls --debug

Enable AWS CLI debug logging when troubleshooting authentication or API problems.

aws sts get-caller-identity --profile production

Verify credentials for a specific AWS profile.

CI/CD AWS Workflow

aws sts get-caller-identity

Verify AWS credentials at the beginning of a CI/CD job.

aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com

Authenticate Docker with an Amazon ECR registry.

docker build -t myapp:$BUILD_NUMBER .

Build a Docker image using a CI build number as the tag.

docker tag myapp:$BUILD_NUMBER ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com/myapp:$BUILD_NUMBER

Tag the Docker image for the ECR repository.

docker push ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com/myapp:$BUILD_NUMBER

Push a CI-built Docker image to Amazon ECR.

aws eks update-kubeconfig --region ap-south-1 --name production

Configure kubectl access to an EKS cluster in a deployment pipeline.

kubectl apply -f k8s/

Deploy Kubernetes manifests after configuring EKS access.

kubectl rollout status deployment/myapp

Wait for the Kubernetes deployment rollout to complete.

Recommended AWS DevOps Workflow

# Check AWS identity
aws sts get-caller-identity

# Configure ECR authentication
aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com

# Build application image
docker build -t myapp:$BUILD_NUMBER .

# Tag image
docker tag myapp:$BUILD_NUMBER ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com/myapp:$BUILD_NUMBER

# Push image
docker push ACCOUNT_ID.dkr.ecr.ap-south-1.amazonaws.com/myapp:$BUILD_NUMBER

# Configure EKS access
aws eks update-kubeconfig --region ap-south-1 --name production

# Deploy application
kubectl apply -f k8s/

# Check deployment
kubectl get pods

# Check rollout
kubectl rollout status deployment/myapp

DevOpsCommands Tip

Avoid putting long-lived AWS access keys directly into Jenkins, GitHub Actions or other CI/CD configuration. Prefer short-lived credentials and IAM roles where the deployment environment supports them.