AWS for DevOps — AWS CLI Setup

3 minute read

AWS CLI Setup

The AWS Command Line Interface (CLI) is the primary tool DevOps engineers use to interact with AWS. While the Console is great for learning, real automation happens on the command line.

Why the CLI?

Console (Web UI) CLI
Good for exploring and learning Good for automation and scripting
Click-based — slow for repetitive tasks Command-based — fast and scriptable
Cannot be version-controlled Commands can be stored in scripts, committed to Git
Manual — prone to human error Reproducible — same command, same result

Rule of thumb: Learn in the Console, automate with the CLI.

Installing AWS CLI v2

macOS (Homebrew):

$ brew install awscli

macOS (Package):

$ curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
$ sudo installer -pkg AWSCLIV2.pkg -target /

Linux (x86_64):

$ curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
$ unzip awscliv2.zip
$ sudo ./aws/install

Windows:

Download and run the MSI installer from awscli.amazonaws.com.

Verify the installation:

$ aws --version
aws-cli/2.15.30 Python/3.11.8 Darwin/23.4.0 exe/x86_64 prompt/off

Creating an IAM User for CLI Access

Never use the root account for daily work. The root account has unrestricted access and should only be used for billing and initial setup.

  1. Sign in to the Console as root
  2. Go to IAM → Users → Create User
  3. Name it devops-admin
  4. Attach the policy AdministratorAccess (for learning — we will restrict this later)
  5. Go to Security credentials → Create access key
  6. Choose Command Line Interface (CLI) as the use case
  7. Save the Access Key ID and Secret Access Key

Configuring the CLI

$ aws configure
AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-east-1
Default output format [None]: json

This creates two files:

$ cat ~/.aws/credentials
[default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

$ cat ~/.aws/config
[default]
region = us-east-1
output = json

Verifying the Setup

Test your configuration by calling the STS (Security Token Service) API:

$ aws sts get-caller-identity
{
    "UserId": "AIDAIOSFODNN7EXAMPLE",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/devops-admin"
}

If you see your account number and user ARN, the CLI is configured correctly.

Named Profiles

If you work with multiple AWS accounts (dev, staging, production), use named profiles:

$ aws configure --profile dev
AWS Access Key ID: AKIADEV...
AWS Secret Access Key: ...
Default region name: us-east-1
Default output format: json

$ aws configure --profile prod
AWS Access Key ID: AKIAPROD...
AWS Secret Access Key: ...
Default region name: us-east-1
Default output format: json

Use a profile with:

$ aws s3 ls --profile dev
$ aws ec2 describe-instances --profile prod

Or set the default profile for a session:

$ export AWS_PROFILE=dev
$ aws s3 ls    # uses dev profile

AWS CLI Output Formats

The CLI supports three output formats:

Format Flag Use Case
json --output json Default, machine-readable, pipe to jq
table --output table Human-readable, good for exploration
text --output text Tab-separated, good for scripting with awk

Example — list S3 buckets in table format:

$ aws s3 ls --output table
---------------------------------------------
|               ListBuckets                 |
+-------------------------------------------+
|  2025-01-15  my-app-artifacts             |
|  2025-02-20  my-app-logs                  |
+-------------------------------------------+

Useful CLI Commands to Know

# Who am I?
$ aws sts get-caller-identity

# List all EC2 instances
$ aws ec2 describe-instances --query "Reservations[].Instances[].InstanceId" --output text

# List all S3 buckets
$ aws s3 ls

# Get current region
$ aws configure get region

# Help for any command
$ aws ec2 help
$ aws s3 cp help

Common Mistake

Hardcoding access keys in scripts or committing them to Git.

Never put AWS credentials in source code. Use environment variables, named profiles, or (better yet) IAM roles with instance profiles for EC2 and task roles for ECS.

If you accidentally commit keys to Git, rotate them immediately:

$ aws iam create-access-key --user-name devops-admin
$ aws iam delete-access-key --user-name devops-admin --access-key-id AKIAOLD...

Quick Reference

Concept Detail
Install brew install awscli (macOS), download zip (Linux)
Configure aws configure — sets access key, secret key, region, output
Verify aws sts get-caller-identity
Profiles aws configure --profile dev for multi-account
Output json (default), table (human), text (scripting)
Golden rule Never commit access keys to Git

Next → Practice Exercises

Updated:

You may also enjoy