AWS CLI Setup and Essential Commands for Cloud Engineers

Overview

This tutorial walks you through installing and configuring the AWS Command Line Interface (AWS CLI), then puts it to work with real commands across core AWS services. By the end, you will be able to authenticate to AWS, query resources, and automate basic tasks entirely from the terminal.

Prerequisites:

• An active AWS account (free tier is sufficient)
• A terminal — Bash on Linux/macOS or WSL2/Git Bash on Windows
• Basic familiarity with the command line
• An IAM user or IAM Identity Center profile with programmatic access

Why this matters for CLF-C02: The AWS Cloud Practitioner exam tests your understanding of how users interact with AWS — Console, CLI, and SDKs are all fair game. Knowing what the CLI is, how credentials work, and which services it touches directly maps to the Cloud Concepts and Security and Compliance domains.

Getting Started

Install the AWS CLI v2, the current production version. Avoid v1 — it is deprecated for most use cases.

Linux / WSL2:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version

macOS (Homebrew):

brew install awscli
aws --version

Expected output: aws-cli/2.x.x Python/3.x.x ...

Next, configure your credentials. The fastest method for a single IAM user is aws configure:

aws configure

You will be prompted for four values:

AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-east-1
Default output format [None]: json

Credentials are stored in ~/.aws/credentials and region/output settings in ~/.aws/config. Never commit these files to source control. Add them to .gitignore immediately.

# Verify the active identity at any time
aws sts get-caller-identity

A successful response confirms authentication is working:

{
    "UserId": "AIDAIOSFODNN7EXAMPLE",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/your-iam-user"
}

Core Service Commands — S3, EC2, and IAM

Amazon S3 is one of the most CLI-friendly services. The aws s3 subcommand covers high-level operations, while aws s3api gives you fine-grained API control.

# List all buckets in your account
aws s3 ls

# Create a new bucket (bucket names are globally unique)
aws s3 mb s3://cloudninjas-demo-bucket-20240101

# Upload a file
aws s3 cp ./report.csv s3://cloudninjas-demo-bucket-20240101/reports/report.csv

# Sync a local directory to S3 (only uploads changed files)
aws s3 sync ./local-folder s3://cloudninjas-demo-bucket-20240101/backups/

# List objects inside a bucket
aws s3 ls s3://cloudninjas-demo-bucket-20240101 --recursive --human-readable

# Delete an object
aws s3 rm s3://cloudninjas-demo-bucket-20240101/reports/report.csv

Common pitfall: Forgetting the --region flag when creating a bucket outside us-east-1. S3 requires an explicit LocationConstraint for all other regions:

aws s3api create-bucket \
  --bucket cloudninjas-ca-bucket \
  --region ca-central-1 \
  --create-bucket-configuration LocationConstraint=ca-central-1

Amazon EC2 commands let you describe, start, stop, and terminate instances without touching the Console:

# Describe all running instances in a region
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query "Reservations[*].Instances[*].{ID:InstanceId,Type:InstanceType,IP:PublicIpAddress}" \
  --output table

# Stop an instance
aws ec2 stop-instances --instance-ids i-0abcd1234efgh5678

# Start an instance
aws ec2 start-instances --instance-ids i-0abcd1234efgh5678

# Describe available AMIs published by Amazon
aws ec2 describe-images \
  --owners amazon \
  --filters "Name=name,Values=al2023-ami-*" "Name=architecture,Values=x86_64" \
  --query "Images | sort_by(@, &CreationDate) | [-1].{Name:Name,ID:ImageId}"

The --query flag uses JMESPath syntax to filter JSON output on the client side — essential for scripting. The --output table flag makes results human-readable in the terminal.

IAM commands are critical for security audits:

# List all IAM users
aws iam list-users --output table

# List groups attached to a user
aws iam list-groups-for-user --user-name alice

# List attached policies for a user
aws iam list-attached-user-policies --user-name alice

# Generate a credential report (CSV of all users and their key ages)
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 --decode

Profiles, Regions, and Output Formats

Real-world engineers work with multiple AWS accounts and regions daily. Named profiles let you switch contexts safely without overwriting your default credentials.

# Configure a secondary profile for a production account
aws configure --profile production

# Use that profile for any command with --profile
aws s3 ls --profile production

# Or export it as an environment variable for your entire session
export AWS_PROFILE=production
aws sts get-caller-identity  # confirms you are in the production account

# Override the region on a per-command basis
aws ec2 describe-instances --region eu-west-1 --profile production

Environment variables always take precedence over ~/.aws/config. The full precedence order is: CLI flags → Environment variables → AWS config file → IAM role (if on EC2/ECS). Knowing this order prevents hours of debugging authentication issues.

Output formats — choose the right one for the job:

# json  — default, best for piping into jq
aws ec2 describe-vpcs --output json | jq '.Vpcs[].VpcId'

# table — best for quick human review
aws iam list-users --output table

# text  — best for shell scripting and grep/awk
aws ec2 describe-instances \
  --query "Reservations[*].Instances[*].InstanceId" \
  --output text

# yaml  — readable, good for config review
aws s3api get-bucket-versioning \
  --bucket cloudninjas-demo-bucket-20240101 \
  --output yaml

Best practice: In automation scripts, always pin --region and --output json explicitly. Never rely on ambient environment settings inside CI/CD pipelines — it causes silent failures when pipelines run in different environments.

Exam Tips for AWS Cloud Practitioner (CLF-C02)

The CLF-C02 exam does not require you to memorize every CLI flag, but it does test conceptual understanding of how the CLI fits into the AWS ecosystem.

Key concepts that appear on the exam:

• The AWS CLI is one of three primary ways to interact with AWS — alongside the Management Console and SDKs
• The CLI requires programmatic access credentials (Access Key ID + Secret Access Key) — not your Console username/password
• IAM roles are the preferred credential method for CLI use on EC2 instances — never store long-term keys on an instance
• The CLI uses the same underlying AWS APIs as the Console — there is no functional difference in what they can do
• AWS CloudShell is a browser-based CLI environment that requires no local installation and uses your Console session credentials

Common exam scenarios:

• "A developer needs to automate S3 uploads from a script. What credentials approach follows least-privilege best practices?" — Answer: Create an IAM user with only the required S3 permissions and use access keys, or better, attach an IAM role to the compute resource.
• "Which tool lets a user run AWS CLI commands without installing anything locally?" — Answer: AWS CloudShell
• "What file stores AWS CLI credentials on a local machine?" — Answer: ~/.aws/credentials

Quick reference commands for exam preparation:

# Confirm who you are authenticated as
aws sts get-caller-identity

# List regions available to your account
aws ec2 describe-regions --output table

# Check your account ID
aws sts get-caller-identity --query Account --output text

# List S3 buckets (classic exam demo command)
aws s3 ls

Summary

You have installed the AWS CLI v2, configured credentials with aws configure, and run real commands against S3, EC2, and IAM. You also learned how to manage multiple profiles, control output formats, and use JMESPath queries to filter results programmatically.

Key takeaways:

• Always run aws sts get-caller-identity first to confirm your active identity
• Use named profiles to manage multiple accounts safely
• Pin --region and --output in scripts to avoid environment-dependent failures
• Never store credentials in code — use IAM roles for compute workloads
• The --query flag with JMESPath is essential for clean, scriptable output

Next steps:

1. Practice the commands in this tutorial against your own AWS free-tier account
2. Explore aws help and aws s3 help to discover additional subcommands
3. Set up AWS CloudShell in the Console as a zero-config alternative
4. Read the CloudNinjas AWS Cloud Practitioner (CLF-C02) Certification Guide for full exam domain coverage