TopolearnThe CLI is the fastest way to inspect and script AWS, and the same credential setup is reused by every SDK.
AWS CLI v2 maps every API operation to a command: aws <service> <operation> --param value. Run aws s3api put-object help for any command's reference.
Credentials and settings live in ~/.aws/config and ~/.aws/credentials, organised into profiles. The recommended way to sign in is IAM Identity Center: aws configure sso writes a profile, aws sso login opens a browser, and the CLI caches short-lived credentials. aws configure with an access key also works but stores a long-lived secret on disk, which you should avoid. Pick a profile with --profile dev or export AWS_PROFILE=dev, and a Region with --region or AWS_REGION.
Output formats are json (default), yaml, text and table. Two flags look similar but differ:
--filtersis sent to the service and filters on the server (supported by many EC2describe-*calls).--queryis a JMESPath expression applied by the CLI to the response, for picking and reshaping fields.
The CLI follows pagination tokens automatically and returns everything; use --max-items to limit it. Set AWS_PAGER="" or --no-cli-pager in scripts so output isn't piped to less.
Higher-level helpers exist for some services, notably aws s3 cp, aws s3 sync and aws s3 ls, alongside the 1:1 API commands in aws s3api. Many mutating EC2 commands accept --dry-run to check permissions without doing anything.
Example
# ~/.aws/config written by `aws configure sso`
# [profile dev]
# sso_session = acme
# sso_account_id = 111122223333
# sso_role_name = DeveloperAccess
# region = eu-west-1
# [sso-session acme]
# sso_start_url = https://acme.awsapps.com/start
# sso_region = eu-west-1
aws sso login --profile dev
export AWS_PROFILE=dev AWS_PAGER=""
# Server-side filter, then client-side reshaping
aws ec2 describe-instances \
--filters Name=instance-state-name,Values=running \
--query 'Reservations[].Instances[].[InstanceId,InstanceType]' --output table
aws s3api list-buckets --query 'Buckets[?starts_with(Name, `logs-`)].Name' --output text
# logs-prod logs-stagingRemember
- Use profiles and IAM Identity Center (aws sso login) instead of stored access keys
- --filters runs on the server; --query (JMESPath) runs in the CLI
- aws s3 has convenience commands; aws s3api is the raw API
Watch out for
- Hard-coding a long-lived access key in ~/.aws/credentials on a laptop or CI runner.