AWS Cheatsheet

CLI Setup

Use this AWS reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

Installation

# macOS (Homebrew)
brew install awscli

# macOS / Linux (official pkg)
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip
unzip awscliv2.zip && sudo ./aws/install

# Windows (MSI)
# Download: https://awscli.amazonaws.com/AWSCLIV2.msi

aws --version   # aws-cli/2.x.x

Configure Credentials

aws configure                        # interactive wizard
aws configure --profile prod         # named profile

# What it writes to ~/.aws/credentials and ~/.aws/config:
# [default]
# aws_access_key_id = AKIA...
# aws_secret_access_key = ...
# region = us-east-1
# output = json

Credentials File Layout

# ~/.aws/credentials
[default]
aws_access_key_id     = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[prod]
aws_access_key_id     = AKIA...
aws_secret_access_key = ...

# ~/.aws/config
[default]
region = us-east-1
output = json

[profile prod]
region = us-west-2
output = table

Environment Variables

Variable	Purpose
`AWS_ACCESS_KEY_ID`	Override key ID
`AWS_SECRET_ACCESS_KEY`	Override secret
`AWS_SESSION_TOKEN`	Temp session token (STS/role)
`AWS_DEFAULT_REGION`	Override region
`AWS_PROFILE`	Select named profile
`AWS_DEFAULT_OUTPUT`	`json` \| `text` \| `table` \| `yaml`

export AWS_PROFILE=prod
export AWS_DEFAULT_REGION=eu-west-1

Credential Precedence (highest to lowest)

CLI flags (--region, --profile)
Environment variables
~/.aws/credentials + ~/.aws/config
EC2/ECS/Lambda instance/task role (metadata service)
Container credential provider
SSO / credential process

Common Global Flags

Flag	Description
`--profile <name>`	Use named profile
`--region <region>`	Override region for this call
`--output json\|text\|table\|yaml`	Output format
`--query '<JMESPath>'`	Filter/transform JSON output
`--no-cli-pager`	Disable pager for long output
`--debug`	Verbose HTTP + signing debug

--dry-run is not a global flag — it is a per-command option on many EC2 commands (validates permissions without executing).

Output Filtering with --query

# List only instance IDs
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].InstanceId' \
  --output text

# Get a specific tag value
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].{ID:InstanceId,Name:Tags[?Key==`Name`].Value|[0]}' \
  --output table

# Filter running instances
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].InstanceId' \
  --output text

SSO / IAM Identity Center

aws configure sso
# Prompts: SSO start URL, SSO region, account, role

aws sso login --profile my-sso-profile
aws s3 ls --profile my-sso-profile

# Auto-refresh token
aws configure sso-session

Assume Role (STS)

aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/MyRole \
  --role-session-name mysession \
  --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
  --output text

# One-liner to export temp creds
eval $(aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/MyRole \
  --role-session-name dev \
  --query 'Credentials' \
  --output text | awk '{print "export AWS_ACCESS_KEY_ID="$1"\nexport AWS_SECRET_ACCESS_KEY="$2"\nexport AWS_SESSION_TOKEN="$3}')

Useful Diagnostics

aws sts get-caller-identity          # who am I (account, ARN, UserId)
aws configure list                   # show active config + source
aws configure list-profiles          # all named profiles
aws ec2 describe-regions --output table   # all available regions

CLI v2 Auto-Completion

# bash
echo 'complete -C aws_completer aws' >> ~/.bashrc

# zsh
echo 'autoload bashcompinit && bashcompinit' >> ~/.zshrc
echo 'complete -C aws_completer aws'         >> ~/.zshrc
source ~/.zshrc