Complete AWS CLI Cheatsheet

This page serves as a quick reference for the most commonly used AWS CLI commands. Keep it handy!

Pro Tip

If you have multiple AWS accounts, use bash aliases:

alias aws-prod="aws --profile work-prod"
alias aws-dev="aws --profile work-dev"
alias aws-self="aws --profile personal"

To format the output into a readable table:

aws ec2 describe-instances | jq ... | column -t

EC2 - Elastic Compute Cloud

List Instances

# Instance ID, Type and Name
aws ec2 describe-instances | jq -r '.Reservations[].Instances[]|.InstanceId+" "+.InstanceType+" "+(.Tags[] | select(.Key=="Name").Value)'

# Instances with public IP and Name
aws ec2 describe-instances --query 'Reservations[*].Instances[?not_null(PublicIpAddress)]' | jq -r '.[][]|.PublicIpAddress+" "+(.Tags[]|select(.Key=="Name").Value)'

VPC and Subnets

# List of VPCs with CIDR
aws ec2 describe-vpcs | jq -r '.Vpcs[]|.VpcId+" "+(.Tags[]|select(.Key=="Name").Value)+" "+.CidrBlock'

# List of subnets for a VPC
aws ec2 describe-subnets --filter Name=vpc-id,Values=vpc-0d1c1cf4e980ac593 | jq -r '.Subnets[]|.SubnetId+" "+.CidrBlock+" "+(.Tags[]|select(.Key=="Name").Value)'

Security Groups

# List all Security Groups
aws ec2 describe-security-groups | jq -r '.SecurityGroups[]|.GroupId+" "+.GroupName'

# Security Groups of an instance
aws ec2 describe-instances --instance-ids i-0dae5d4daa47fe4a2 | jq -r '.Reservations[].Instances[].SecurityGroups[]|.GroupId+" "+.GroupName'

# Modify Security Groups of an instance
aws ec2 modify-instance-attribute --instance-id i-0dae5d4daa47fe4a2 --groups sg-02a63c67684d8deed sg-0dae5d4daa47fe4a2

# Display rules (FromAddress and ToPort)
aws ec2 describe-security-groups --group-ids sg-02a63c67684d8deed | jq -r '.SecurityGroups[].IpPermissions[]|. as $parent | .IpRanges[]|.CidrIp+" "+($parent.ToPort|tostring)'

# Add a rule
aws ec2 authorize-security-group-ingress --group-id sg-02a63c67684d8deed --protocol tcp --port 443 --cidr 35.0.0.1/32

# Remove a rule
aws ec2 revoke-security-group-ingress --group-id sg-02a63c67684d8deed --protocol tcp --port 443 --cidr 35.0.0.1/32

# Delete a Security Group
aws ec2 delete-security-group --group-id sg-02a63c67684d8deed

S3 - Simple Storage Service

Basic Operations

# List buckets
aws s3 ls

# List files in a bucket
aws s3 ls s3://my-bucket/path/

# Create a bucket
aws s3 mb s3://my-new-bucket

# Delete a bucket (force = delete contents)
aws s3 rb s3://my-bucket --force

File Transfer

# Download an S3 object to local
aws s3 cp s3://my-bucket/file.tar .

# Upload a local file to S3
aws s3 cp backup.tar s3://my-bucket/

# Delete an S3 object
aws s3 rm s3://my-bucket/secret-file.gz

# Sync a bucket to local
aws s3 sync s3://my-bucket/ /media/backup/

# Sync a local folder to bucket
aws s3 sync /home/user/downloads s3://my-bucket/

# Generate pre-signed URL (expires in 3600 seconds)
aws s3 presign s3://my-bucket/report.pdf --expires-in 3600

API Gateway

# List of API Gateways (ID and Name)
aws apigateway get-rest-apis | jq -r '.items[] | .id+" "+.name'

# List of API keys
aws apigateway get-api-keys | jq -r '.items[] | .id+" "+.name'

# List of domain names
aws apigateway get-domain-names | jq -r '.items[] | .domainName+" "+.regionalDomainName'

# List of resources for an API
aws apigateway get-resources --rest-api-id ee86b4cde | jq -r '.items[] | .id+" "+.path'

# Find the Lambda associated with a resource
aws apigateway get-integration --rest-api-id ee86b4cde --resource-id 69ef7d4c8 --http-method GET | jq -r '.uri'

ELB - Elastic Load Balancer

# List of ELB hostnames
aws elbv2 describe-load-balancers --query 'LoadBalancers[*].DNSName' | jq -r 'to_entries[] | .value'

# List of ELB ARNs
aws elbv2 describe-load-balancers | jq -r '.LoadBalancers[] | .LoadBalancerArn'

# List of Target Groups ARNs
aws elbv2 describe-target-groups | jq -r '.TargetGroups[] | .TargetGroupArn'

# Find instances of a Target Group
aws elbv2 describe-target-health --target-group-arn arn:aws:elasticloadbalancing:...:targetgroup/frontend/b6da07d35 | jq -r '.TargetHealthDescriptions[].Target.Id'

RDS - Relational Database Service

# List of DB clusters
aws rds describe-db-clusters | jq -r '.DBClusters[] | .DBClusterIdentifier+" "+.Endpoint'

# List of DB instances
aws rds describe-db-instances | jq -r '.DBInstances[] | .DBInstanceIdentifier+" "+.DBInstanceClass+" "+.Endpoint.Address'

# Create an instance snapshot
aws rds create-db-snapshot --db-snapshot-identifier backend-snapshot-001 --db-instance-identifier backend-dev

# Create a cluster snapshot
aws rds create-db-cluster-snapshot --db-cluster-snapshot-identifier prod-snapshot-001 --db-cluster-identifier backend-prod

ElastiCache

# List of clusters (type and name)
aws elasticache describe-cache-clusters | jq -r '.CacheClusters[] | .CacheNodeType+" "+.CacheClusterId'

# List of replication groups
aws elasticache describe-replication-groups | jq -r '.ReplicationGroups[] | .ReplicationGroupId+" "+.NodeGroups[].PrimaryEndpoint.Address'

# List of snapshots
aws elasticache describe-snapshots | jq -r '.Snapshots[] | .SnapshotName'

# Create a snapshot
aws elasticache create-snapshot --snapshot-name backend-snap-001 --replication-group-id backend-login --cache-cluster-id backend-001

# Delete a snapshot
aws elasticache delete-snapshot --snapshot-name backend-snap-001

# Scale up/down replicas
aws elasticache increase-replica-count --replication-group-id backend-login --apply-immediately
aws elasticache decrease-replica-count --replication-group-id backend-login --apply-immediately

Lambda

# List of functions (name, runtime, memory)
aws lambda list-functions | jq -r '.Functions[] | .FunctionName+" "+.Runtime+" "+(.MemorySize|tostring)'

# List of layers
aws lambda list-layers | jq -r '.Layers[] | .LayerName'

# List of event sources
aws lambda list-event-source-mappings | jq -r '.EventSourceMappings[] | .FunctionArn+" "+.EventSourceArn'

# Download function code
aws lambda get-function --function-name MyFunction | jq -r .Code.Location
# Then wget or curl on the returned URL

CloudWatch

# List of alarms and their status
aws cloudwatch describe-alarms | jq -r '.MetricAlarms[] | .AlarmName+" "+.Namespace+" "+.StateValue'

# Create a high CPU alarm
aws cloudwatch put-metric-alarm \
  --alarm-name high-cpu-usage \
  --alarm-description "Alarm when CPU exceeds 70%" \
  --metric-name CPUUtilization \
  --namespace AWS/EC2 \
  --statistic Average \
  --period 300 \
  --threshold 70 \
  --comparison-operator GreaterThanThreshold \
  --dimensions Name=InstanceId,Value=i-12345678 \
  --evaluation-periods 2 \
  --alarm-actions arn:aws:sns:region:account:topic

# Create a StatusCheckFailed alarm
aws cloudwatch put-metric-alarm \
  --alarm-name EC2-StatusCheckFailed \
  --alarm-description "EC2 StatusCheckFailed" \
  --metric-name StatusCheckFailed_Instance \
  --namespace AWS/EC2 \
  --statistic Maximum \
  --period 60 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --dimensions Name=InstanceId,Value=i-12345678 \
  --evaluation-periods 2

Route 53

# List of domains (hosted zones)
aws route53 list-hosted-zones | jq -r '.HostedZones[]|.Id+" "+.Name'

# List of records for a zone
aws route53 list-resource-record-sets --hosted-zone-id /hostedzone/ZEB1PAH4U | jq -r '.ResourceRecordSets[]| .Type+" "+.Name+" "+(.ResourceRecords[].Value // .AliasTarget.DNSName)'

SNS - Simple Notification Service

# List of topics
aws sns list-topics | jq -r '.Topics[] | .TopicArn'

# List of subscriptions
aws sns list-subscriptions | jq -r '.Subscriptions[] | .TopicArn+" "+.Protocol+" "+.Endpoint'

# Publish a message
aws sns publish \
  --topic-arn arn:aws:sns:region:account:my-topic \
  --message "Alert!" \
  --subject "Important Notification"

DynamoDB

# List of tables
aws dynamodb list-tables | jq -r .TableNames[]

# Scan all items (warning: can be long!)
aws dynamodb scan --table-name my-table

# Count items
aws dynamodb scan --table-name my-table --select COUNT | jq .ScannedCount

# Get an item by key
aws dynamodb get-item --table-name my-table --key '{"email": {"S": "user@example.com"}}'

# Get specific fields
aws dynamodb get-item --table-name my-table --key '{"email": {"S": "user@example.com"}}' --attributes-to-get event_type

# Delete an item
aws dynamodb delete-item --table-name my-table --key '{"email": {"S": "user@example.com"}}'

SQS - Simple Queue Service

# List of queues
aws sqs list-queues | jq -r '.QueueUrls[]'

# Create a queue
aws sqs create-queue --queue-name my-queue.fifo | jq -r .QueueUrl

# Count messages
aws sqs get-queue-attributes --queue-url https://sqs.region.amazonaws.com/account/my-queue --attribute-names ApproximateNumberOfMessages

# Send a message
aws sqs send-message --queue-url https://sqs.region.amazonaws.com/account/my-queue --message-body "Hello World"

# Receive a message
aws sqs receive-message --queue-url https://sqs.region.amazonaws.com/account/my-queue | jq -r '.Messages[].Body'

# Delete a message
aws sqs delete-message --queue-url https://sqs.region.amazonaws.com/account/my-queue --receipt-handle <HANDLE>

# Purge a queue
aws sqs purge-queue --queue-url https://sqs.region.amazonaws.com/account/my-queue

# Delete a queue
aws sqs delete-queue --queue-url https://sqs.region.amazonaws.com/account/my-queue

CloudFront

# List of distributions and origins
aws cloudfront list-distributions | jq -r '.DistributionList.Items[] | .DomainName+" "+.Origins.Items[0].DomainName'

# Create a cache invalidation
aws cloudfront create-invalidation --distribution-id D12B09E8A0A996 --paths "/blog/*" "/assets/*" | jq -r '.Invalidation.Id'

# Check invalidation status
aws cloudfront get-invalidation --distribution-id D12B09E8A0A996 --id IALJ5AL93ZD79 | jq -r '.Invalidation.Status'

Amplify

# List of apps and repositories
aws amplify list-apps | jq -r '.apps[] | .name+" "+.defaultDomain+" "+.repository'

Cognito

# List of User Pools
aws cognito-idp list-user-pools --max-results 60 | jq -r '.UserPools[] | .Id+" "+.Name'

# List of users (phone and email)
aws cognito-idp list-users --user-pool-id ap-southeast-1_b6da07d35 | jq -r '.Users[].Attributes | from_entries | .sub+" "+.phone_number+" "+.email'

IAM - Users

# List of users
aws iam list-users | jq -r '.Users[]|.UserId+" "+.UserName'

# Get a user
aws iam get-user --user-name kaiser

# Create a user
aws iam create-user --user-name new-user

# Delete a user
aws iam delete-user --user-name old-user

# List of access keys
aws iam list-access-keys --user-name my-user | jq -r .AccessKeyMetadata[].AccessKeyId

# Delete an access key
aws iam delete-access-key --user-name my-user --access-key-id AKIAXXXXXXXX

# Enable/Disable a key
aws iam update-access-key --status Inactive --user-name my-user --access-key-id AKIAXXXXXXXX
aws iam update-access-key --status Active --user-name my-user --access-key-id AKIAXXXXXXXX

# Generate a new key
aws iam create-access-key --user-name my-user | jq -r '.AccessKey | .AccessKeyId+" "+.SecretAccessKey'

IAM - Groups

# List of groups
aws iam list-groups | jq -r .Groups[].GroupName

# Create/Delete a group
aws iam create-group --group-name new-group
aws iam delete-group --group-name old-group

# List of policies
aws iam list-policies | jq -r '.Policies[]|.PolicyName+" "+.Arn'
aws iam list-policies --scope AWS | jq -r '.Policies[]|.PolicyName+" "+.Arn'   # AWS managed
aws iam list-policies --scope Local | jq -r '.Policies[]|.PolicyName+" "+.Arn' # Custom

# Entities for a policy
aws iam list-entities-for-policy --policy-arn arn:aws:iam::account:policy/MyPolicy

# Policies of a group
aws iam list-attached-group-policies --group-name my-group

# Attach a policy to a group
aws iam attach-group-policy --group-name my-group --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# Detach a policy
aws iam detach-group-policy --group-name my-group --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# Add a user to a group
aws iam add-user-to-group --group-name my-group --user-name my-user

# Remove a user from a group
aws iam remove-user-from-group --group-name my-group --user-name my-user

# List of users in a group
aws iam get-group --group-name my-group

# List of groups for a user
aws iam list-groups-for-user --user-name my-user

Service Summary

Service	Base Command	Description
EC2	`aws ec2 describe-instances`	Compute instances
S3	`aws s3 ls`	Object storage
RDS	`aws rds describe-db-instances`	Databases
Lambda	`aws lambda list-functions`	Serverless
IAM	`aws iam list-users`	Identity and access
VPC	`aws ec2 describe-vpcs`	Virtual network
CloudWatch	`aws cloudwatch describe-alarms`	Monitoring
SNS	`aws sns list-topics`	Notifications
SQS	`aws sqs list-queues`	Message queues
DynamoDB	`aws dynamodb list-tables`	NoSQL
Route 53	`aws route53 list-hosted-zones`	DNS
CloudFront	`aws cloudfront list-distributions`	CDN
ELB	`aws elbv2 describe-load-balancers`	Load Balancing

Return: AWS CLI Installation

EC2 - Elastic Compute Cloud​

List Instances​

VPC and Subnets​

Security Groups​

S3 - Simple Storage Service​

Basic Operations​

File Transfer​

Secure Sharing​

API Gateway​

ELB - Elastic Load Balancer​

RDS - Relational Database Service​

ElastiCache​

Lambda​

CloudWatch​

Route 53​

SNS - Simple Notification Service​

DynamoDB​

SQS - Simple Queue Service​

CloudFront​

Amplify​

Cognito​

IAM - Users​

IAM - Groups​

Service Summary​

EC2 - Elastic Compute Cloud

List Instances

VPC and Subnets

Security Groups

S3 - Simple Storage Service

Basic Operations

File Transfer

Secure Sharing

API Gateway

ELB - Elastic Load Balancer

RDS - Relational Database Service

ElastiCache

Lambda

CloudWatch

Route 53

SNS - Simple Notification Service

DynamoDB

SQS - Simple Queue Service

CloudFront

Amplify

Cognito

IAM - Users

IAM - Groups

Service Summary