AWS CLI

Unified command-line tool for controlling and scripting every AWS service from a terminal.

Verified against AWS documentation · 2026-09-09

Key facts

01One `aws` binary for every service, same shape every time: `aws <service> <operation> --flags` — it calls the same public APIs the Console does
02`aws configure` writes keys to `~/.aws/credentials` and Region + output format to `~/.aws/config`; `--profile <name>` switches accounts
03Defaults to JSON output; `--output table|text|yaml` and `--query` (JMESPath) trim the wall of output before it hits your screen
04Reality check: v1 entered maintenance mode 5 Aug 2026 and reaches end-of-support 15 Jul 2027 — assume v2 in anything current

Phrases and scenarios that point here.

"Automate", "script", "repeatable", "scheduled", "without using the console" → CLI
"Programmatic access" or "access key ID and secret access key" → CLI or SDK, never Console sign-in
Run AWS commands with nothing installed and no keys stored locally → CloudShell (CLI v2 pre-installed and pre-authenticated in the browser)
An option offers long-lived access keys sitting on a laptop or in a script → wrong answer; IAM roles for EC2 and CI, IAM Identity Center for humans

Application code that calls AWS → the language SDK (boto3, AWS SDK for JavaScript), not shelling out to `aws`
Repeatable, versioned infrastructure with drift detection → CloudFormation, not a folder of shell scripts

01Cleaning up after yourself — a loop over `aws ec2 terminate-instances` kills a forgotten dev fleet in one command instead of forty Console clicks
02Bulk work the Console has no button for — `aws s3 sync` moving 50,000 objects, or tagging every untagged EBS volume in an account
03CI/CD steps that run with no human present — a build job assumes a role, then `aws ecr get-login-password` and `aws ecs update-service`
04Fast audits — `aws iam list-users --output table` answers "who has access?" before the Console page finishes loading
05Multi-account work — named profiles let one terminal jump between dev, staging, and prod with `--profile prod` instead of logging out and back in

01The CLI itself is free — no charge to download, install, or run commands
02You pay for what the commands do: `aws ec2 run-instances` starts a billable instance, `aws s3 cp` bills requests plus storage
03Read-only calls aren't automatically free — CloudWatch `get-metric-data` bills per metric requested and is excluded from the free tier, so a script polling in a tight loop shows up on the bill
04Data transfer follows normal rules: `aws s3 cp` down to your laptop is internet egress; the same copy from an EC2 instance in the same Region is not
05CloudShell (the CLI in your browser) is also free, with 1 GB of persistent storage per Region included