AWS CLI Reference

aws s3 ls

List all S3 buckets in the account.

aws s3 ls s3://<bucket>/[prefix]

List objects in a bucket, optionally filtered by prefix.

aws s3 cp <src> <dst>

Copy a file between local and S3, or between two S3 locations.

aws s3 sync <src> <dst> [--delete]

Synchronise a local directory with an S3 prefix. --delete removes files not present in source.

aws s3 presign s3://<bucket>/<key> --expires-in <sec>

Generate a time-limited presigned URL for private object access.

aws s3 rm s3://<bucket>/<key> [--recursive]

Delete one or more objects from a bucket.

aws ec2 describe-instances [--filters ...]

List EC2 instances with optional filters on tags, state, or instance type.

aws ec2 start-instances --instance-ids <id>

Start one or more stopped EC2 instances.

aws ec2 stop-instances --instance-ids <id>

Stop one or more running EC2 instances.

aws ec2 run-instances --image-id <ami> --instance-type <type> --key-name <key>

Launch a new EC2 instance from an AMI.

aws ec2 describe-security-groups [--group-ids <id>]

List security groups and their inbound/outbound rules.

aws ec2 create-key-pair --key-name <name>

Create a new SSH key pair for EC2 access. The private key is returned once.

aws lambda list-functions

List all Lambda functions in the current region.

aws lambda invoke --function-name <name> <outfile>

Synchronously invoke a Lambda function and save the response.

aws lambda create-function --function-name <name> --runtime <rt> --handler <h> --zip-file <path> --role <arn>

Deploy a new Lambda function from a ZIP package.

aws lambda update-function-code --function-name <name> --zip-file <path>

Update the deployment package of an existing Lambda function.

aws lambda get-function-configuration --function-name <name>

Retrieve runtime, memory, timeout, and environment variables of a Lambda function.

aws lambda add-permission --function-name <name> --statement-id <sid> --action lambda:InvokeFunction --principal <svc>

Grant another AWS service permission to invoke the function.

aws iam list-users

List all IAM users in the account.

aws iam create-user --user-name <name>

Create a new IAM user.

aws iam attach-user-policy --user-name <name> --policy-arn <arn>

Attach a managed IAM policy to a user.

aws iam list-roles

List all IAM roles in the account.

aws iam create-role --role-name <name> --assume-role-policy-document <json>

Create an IAM role with a trust policy.

aws sts get-caller-identity

Return the IAM identity (user/role ARN and account ID) of the current credentials.

aws cloudformation create-stack --stack-name <name> --template-body <file>

Create a new CloudFormation stack from a template.

aws cloudformation update-stack --stack-name <name> --template-body <file>

Update an existing CloudFormation stack with a new template.

aws cloudformation delete-stack --stack-name <name>

Delete a CloudFormation stack and all its resources.

aws cloudformation describe-stacks [--stack-name <name>]

List stacks or get details of a specific stack including outputs and parameters.

aws cloudformation list-stack-resources --stack-name <name>

List all resources managed by a stack with their types and status.

aws cloudformation validate-template --template-body <file>

Check a CloudFormation template for syntax and structural errors.

aws ecs list-clusters

List all ECS clusters in the current region.

aws ecs describe-services --cluster <name> --services <svc>

Get details of one or more ECS services including desired count, running count, and events.

aws ecs update-service --cluster <name> --service <svc> --desired-count <n>

Update task count, task definition, or deployment configuration of an ECS service.

aws ecs register-task-definition --cli-input-json <file>

Register a new revision of an ECS task definition from a JSON file.

aws ecs run-task --cluster <name> --task-definition <td> --launch-type FARGATE --network-configuration <cfg>

Run a one-off task on ECS Fargate with a specified VPC configuration.

aws ecs list-tasks --cluster <name> [--service-name <svc>]

List running task ARNs in a cluster, optionally filtered by service.

aws rds describe-db-instances [--db-instance-identifier <id>]

List RDS instances or get details of a specific DB instance.

aws rds create-db-instance --db-instance-identifier <id> --engine <eng> --db-instance-class <cls> --master-username <user> --master-user-password <pw>

Launch a new RDS database instance.

aws rds create-db-snapshot --db-instance-identifier <id> --db-snapshot-identifier <snap>

Create a manual snapshot of an RDS instance.

aws rds delete-db-instance --db-instance-identifier <id> [--skip-final-snapshot]

Terminate an RDS instance. Use --final-snapshot for a backup before deletion.

aws rds modify-db-instance --db-instance-identifier <id> [options]

Change instance class, storage, or other settings of an existing RDS instance.

aws rds describe-db-snapshots [--db-instance-identifier <id>]

List manual and automated snapshots for an RDS instance.

aws cloudwatch list-metrics --namespace <ns>

List available CloudWatch metrics, optionally filtered by namespace or dimension.

aws cloudwatch get-metric-statistics --namespace <ns> --metric-name <m> --start-time <t> --end-time <t> --period <s> --statistics <stat>

Retrieve aggregated metric data points for a given time range.

aws cloudwatch put-metric-alarm --alarm-name <name> --metric-name <m> --namespace <ns> --threshold <n> --comparison-operator <op>

Create or update a CloudWatch alarm on a metric.

aws cloudwatch describe-alarms [--alarm-names <name>]

List CloudWatch alarms and their current state.

aws logs put-log-events --log-group-name <grp> --log-stream-name <stream> --log-events ...

Write log events to a CloudWatch Logs stream.

aws logs filter-log-events --log-group-name <grp> --filter-pattern <pat>

Search CloudWatch Logs for events matching a filter pattern.