AWS CLI Cheat Sheet
Table of Contents
Volumes
Describing volumes
Describing volumes using a different aws user profile
Listing Available Volumes IDs
Deleting a Volume
Deleting Unused Volumes.. Think Before You Type :-)
Creating a Snapshot
Creating an Image (AMI)
Creating AMI Without Rebooting the Machine
AMIs
Listing AMI(s)
Describing AMI(s)
Listing Amazon AMIs
Using Filters
Lambda
List Functions
Describe a Function
Invoke a Function
Update a Function Code
Publish a Version
List Layers
List Aliases of a Function
Describe an Alias
Create an Alias
Delete an Alias
List Function Tags
Delete a Function
Using AWS Lambda with Scheduled Events
IAM
List Users
List Policies
List Groups
Get Users in a Group
Describing a Policy
List Access Keys
List Keys
List the Access Key IDs for an IAM User
List the SSH Public Keys for a User
S3 API
Listing Buckets
Listing Only Bucket Names
Getting a Bucket Region
Listing the Content of a Bucket
Syncing a Local Folder with a Bucket
Copying Files
Copying Folders
Removing a File from a Bucket
Deleting a Bucket
Emptying a Bucket
VPC
Creating A VPC
Allowing DNS hostnames
Subnets
Creating A Subnet
Auto Assigning Public IPs To Instances In A Public Subnet
Internet Gateway
Creating An IGW
Attaching An IGW to A VPC
NAT
Setting Up A NAT Gateway
Route Tables
Creating A Public Route Table
Creating A Private Route Tables
CloudFront
Listing Distributions
Invalidating Files From a Distribution
Sync a Local Folder with a CLoudFront Distribution
Sync and Invalidate at the Same Time:
RDS
List Databases
List Public Databases
List Non Protected Databases (DeletionProtection)
Describe the Automated Backups for a DB Instance
Create a DB Cluster
Create a DB Instance
Create a DB Security Group
Create a Read Replica
Create a Custom DB Cluster Endpoint
Apply Tag to a DB
Create a Cluster Snapshot
Create a CloudWatch Alarm for a DB Instance
Connect Deeper
Volumes
Describing volumes
aws ec2 describe-volumes
Describing filtered volumes:
aws ec2 describe-volumes --filters Name=status,Values=creating | available |
in-use | deleting | deleted | error
e.g, describing all deleted volumes:
aws ec2 describe-volumes --filters Name=status,Values=deleted
Filters can be applied to the attachment status:
aws ec2 describe-volumes --filters Name=attachment.status,Values=attaching |
attached | detaching | detached
e.g: describing all volumes with the status "attaching":
aws ec2 describe-volumes --filters Name=attachment.status,Values=attaching
This is the generic form. Use --profile <your_profile_name> , if you have multiple AWS profiles or
accounts.
aws ec2 describe-volumes --filters Name:'tag:Name',Values: ['some_values'] --
profile <your_profile_name>
Describing volumes using a different aws user
profile
aws ec2 describe-volumes --filters Name=status,Values=in-use --profile
<your_profile_name>
Listing Available Volumes IDs
aws ec2 describe-volumes --filters Name=status,Values=available |grep
VolumeId|awk '{print $2}' | tr '\n|,|"' ' '
With "profile":
aws ec2 describe-volumes --filters Name=status,Values=available --profile
<your_profile_name>|grep VolumeId|awk '{print $2}' | tr '\n|,|"' ' '
Deleting a Volume
aws ec2 delete-volume --region <region> --volume-id <volume_id>
Deleting Unused Volumes.. Think Before You Type
:-)
for x in $(aws ec2 describe-volumes --filters Name=status,Values=available --
profile <your_profile_name>|grep VolumeId|awk '{print $2}' | tr ',|"' ' '); do
aws ec2 delete-volume --region <region> --volume-id $x; done
With "profile":
for x in $(aws ec2 describe-volumes --filters Name=status,Values=available --
profile <your_profile_name>|grep VolumeId|awk '{print $2}' | tr ',|"' ' '); do
aws ec2 delete-volume --region <region> --volume-id $x --profile
<your_profile_name>; done
Creating a Snapshot
aws ec2 create-snapshot --volume-id <vol-id>
aws ec2 create-snapshot --volume-id <vol-id> --description "snapshot-$(date
+'%Y-%m-%d_%H-%M-%S')"
Creating an Image (AMI)
aws ec2 create-image --instance-id <instance_id> --name "image-$(date +'%Y-%m-
%d_%H-%M-%S')" --description "image-$(date +'%Y-%m-%d_%H-%M-%S')"
Creating AMI Without Rebooting the Machine
aws ec2 create-image --instance-id <instance_id> --name "image-$(date +'%Y-%m-
%d_%H-%M-%S')" --description "image-$(date +'%Y-%m-%d_%H-%M-%S')" --no-reboot
You are free to change the AMI name image-$(date +'%Y-%m-%d_%H-%M-%S') to a name of your
choice.
AMIs
Listing AMI(s)
aws ec2 describe-images
Describing AMI(s)
aws ec2 describe-images --image-ids <image_id> --profile <profile> --region
<region>
e.g:
aws ec2 describe-images --image-ids ami-e24dfa9f --profile terraform --region
eu-west-3
Listing Amazon AMIs
aws ec2 describe-images --owners amazon
Using Filters
e.g: Describing Windows AMIs that are backed by Amazon EBS.
aws ec2 describe-images --filters "Name=platform,Values=windows" "Name=root-
device-type,Values=ebs"
e.g: Describing Ubuntu AMIs
aws ec2 describe-images --filters "Name=name,Values=ubuntu*"
Lambda
List Functions
aws lambda list-functions
Describe a Function
aws lambda get-function --function-name my-function
Invoke a Function
aws lambda invoke --function-name my-function --payload '{ "name": "Bob" }'
response.json
Update a Function Code
aws lambda update-function-code --function-name my-function --zip-file
fileb://my-function.zip
Publish a Version
aws lambda publish-version --function-name my-function
List Layers
Let's take this example in which we want to list information of layers that are compatible with
Python 3.7 runtime.
aws lambda list-layers --compatible-runtime python3.7
Possible layers runtime:
nodejs
nodejs4.3
nodejs6.10
nodejs8.10
nodejs10.x
nodejs12.x
java8
java8.al2
java11
python2.7
python3.6
python3.7
python3.8
dotnetcore1.0
dotnetcore2.0
dotnetcore2.1
dotnetcore3.1
nodejs4.3-edge
go1.x
ruby2.5
ruby2.7
provided
provided.al2
List Aliases of a Function
aws lambda list-aliases --function-name my-function
Describe an Alias
aws lambda get-alias --function-name my-function --name LIVE
Create an Alias
aws lambda create-alias --function-name my-function --description "alias
description goes here" --function-version 1 --name LIVE
Delete an Alias
aws lambda delete-alias --function-name my-function --name LIVE
List Function Tags
aws lambda list-tags --resource arn:aws:lambda:eu-west-
1:xxxxxxxxxxx:function:my-function
Delete a Function
aws lambda delete-function --function-name my-function
Using AWS Lambda with Scheduled Events
sid=Sid$(date +%Y%m%d%H%M%S); aws lambda add-permission --statement-id $sid --
action 'lambda:InvokeFunction' --principal events.amazonaws.com --source-arn
arn:aws:events:<region>:<arn>:rule/AWSLambdaBasicExecutionRole --function-name
function:<awsents> --region <region>
##
IAM
List Users
aws iam list-users
List Policies
aws iam list-policies
List Groups
aws iam list-groups
Get Users in a Group
aws iam get-group --group-name <group_name>
Describing a Policy
aws iam get-policy --policy-arn arn:aws:iam::aws:policy/<policy_name>
List Access Keys
aws iam list-access-keys
List Keys
aws iam list-access-keys
List the Access Key IDs for an IAM User
aws iam list-access-keys --user-name <user_name>
List the SSH Public Keys for a User
aws iam list-ssh-public-keys --user-name <user_name>
S3 API
Listing Buckets
aws s3api list-buckets
Or
aws s3 ls
e.g
aws s3 ls --profile eon01
Listing Only Bucket Names
aws s3api list-buckets --query 'Buckets[].Name'
Getting a Bucket Region
aws s3api get-bucket-location --bucket <bucket_name>
e.g
aws s3api get-bucket-location --bucket practicalaws.com
Listing the Content of a Bucket
aws s3 ls s3://<bucket_name> --region <region>
e.g
aws s3 ls s3://practicalaws.com
aws s3 ls s3://practicalaws.com --region eu-west-1
aws s3 ls s3://practicalaws.com --region eu-west-1 --profile eon01
Syncing a Local Folder with a Bucket
aws s3 sync <local_path> s3://<bucket_name>
e.g
aws s3 sync . s3://practicalaws.com --region eu-west-1
Copying Files
aws s3 cp <file_name> s3://<bucket_name>
Or:
aws s3 cp <file_name> s3://<bucket_name>/<folder_name>/
To copy all files from a filder, look at "Copying Folders". Or use the following example, where I
copy the content of the folder "images (contains images) in the remote folder "images".
cd images
aws s3 cp . s3://saltstackfordevops.com/images --recursive --region us-east-2
Copying Folders
aws s3 cp <folder_name>/ s3://<bucket_name>/ --recursive
To exclude files:
aws s3 cp <folder_name>/ s3://<bucket_name>/ --recursive --exclude "
<file_name_or_a_wildcard>"
e.g: To only include a certain type of files (PNG) and exclude others (JPG)
aws s3 cp practicalaws.com/ s3://practicalaws-backup/ --recursive --exclude
"*.jpg" --include "*.png"
e.g: To exclude a folder
aws s3 cp practicalaws.com/ s3://practicalaws-backup/ --recursive --exclude
".git/*"
Removing a File from a Bucket
aws s3 rm s3://<bucket_name>/<object_name>
e.g
aws s3 rm s3://practicalaws.com/temp.txt
Deleting a Bucket
aws s3 rb s3://<bucket_name> --force
If the bucket is not empty, use --force.
e.g
aws s3 rb s3://practicalaws.com --force
Emptying a Bucket
aws s3 rm s3://<bucket_name>/<key_name> --recursive
e.g
In order to remove tempfiles/file1.txt and tempfiles/file2.txt from practicalaws.com bucket, use:
aws s3 rm s3://practicalaws.com/tempfiles --recursive
Remove all objects using:
aws s3 rm s3://practicalaws.com/tempfiles
Making a Public File Private
aws s3api put-object-acl --acl private --bucket <bucket-name> --key <file_name
or file_path>
e.g:
aws s3api put-object-acl --acl private --bucket practicalaws.com --key
image/logo.png
Making a Public bucket Private
aws s3 ls --recursive s3://<bucket-name> | cut -d' ' -f5- | awk '{print $NF}' |
while read line; do
echo "$line"
aws s3api put-object-acl --acl private --bucket <bucket-name> --key "$line"
done
VPC
Creating A VPC
aws ec2 create-vpc --cidr-block <cidr_block> --regiosn <region>
e.g
aws ec2 create-vpc --cidr-block 10.0.0.0/16 --region eu-west-1
Allowing DNS hostnames
aws ec2 modify-vpc-attribute --vpc-id <vpc_id> --enable-dns-hostnames "
{\"Value\":true}" --region <region>
Subnets
Creating A Subnet
aws ec2 create-subnet --vpc-id <vpc_id> --cidr-block <cidr_block> --
availability-zone <availability_zone> --region <region>
Auto Assigning Public IPs To Instances In A Public
Subnet
aws ec2 modify-subnet-attribute --subnet-id <subnet_id> --map-public-ip-on-
launch --region <region>
Internet Gateway
Creating An IGW
aws ec2 create-internet-gateway --region <region>
Attaching An IGW to A VPC
aws ec2 attach-internet-gateway --internet-gateway-id <igw_id> --vpc-id <vpc_id>
--region <region>
NAT
Setting Up A NAT Gateway
Allocate Elastic IP
aws ec2 allocate-address --domain vpc --region <region>
then use the AllocationId to create the NAT Gateway for the public zone in
aws ec2 create-nat-gateway --subnet-id <subnet_id> --allocation-id
<allocation_id> --region <region>
Route Tables
Creating A Public Route Table
Create the Route Table:
aws ec2 create-route-table --vpc-id <vpc_id> --region <region>
then create a route for an Internet Gateway.
Now, use the outputted Route Table ID:
aws ec2 create-route --route-table-id <route_table_id> --destination-cidr-block
0.0.0.0/0 --gateway-id <igw_id> --region <region>
Finally, associate the public subnet with the Route Table
aws ec2 associate-route-table --route-table-id <route_table_id> --subnet-id
<subnet_id> --region <region>
Creating A Private Route Tables
Create the Route Table
aws ec2 create-route-table --vpc-id <vpc_id> --region <region>
then create a route that points to a NAT Gateway
aws ec2 create-route --route-table-id <route_table_id> --destination-cidr-block
0.0.0.0/0 --nat-gateway-id <net_gateway_id> --region <region>
Finally, associate the subnet
aws ec2 associate-route-table --route-table-id <route_table_id> --subnet-id
<subnet_id> --region <region>
CloudFront
Listing Distributions
In some cases, you need to setup this first:
aws configure set preview.cloudfront true
Then:
aws cloudfront list-distributions
Invalidating Files From a Distribution
To invalidate index and error HTML files from the distribution with the ID Z2W2LX9VBMAPRX:
aws cloudfront create-invalidation --distribution-id Z2W2LX9VBMAPRX --paths
/index.html /error.html
To invalidate everything in the distribution:
aws cloudfront create-invalidation --distribution-id Z2W2LX9VBMAPRX --paths
'/*'
Sync a Local Folder with a CLoudFront Distribution
CloudFront is "attached" to a bucket, you need to upload your files to the bucket.
e.g.:
aws s3 sync . s3://my-bucket.com
If you should keep the files public:
aws s3 sync . s3://my-bucket.com --acl public-read
To copy a single file, you need to:
aws s3 cp file1 s3://my-bucket.com/sub-folder/ --acl <ACL>
Sync and Invalidate at the Same Time:
aws s3 sync . s3://my-bucket.com --acl public-read && aws cloudfront create-
invalidation --distribution-id Z2W2LX9VBMAPRX --paths '/*'
or in case you want to update a single file:
aws s3 cp file1 s3://my-bucket.com/sub-folder/ --acl public-read && aws
cloudfront create-invalidation --distribution-id Z2W2LX9VBMAPRX --paths '/sub-
folder/file1'
RDS
List Databases
aws rds describe-db-instances
or:
aws rds describe-db-instances --query 'DBInstances[].DBInstanceIdentifier'
List Public Databases
aws rds describe-db-instances --query 'DBInstances[?PubliclyAccessible=="true"].
[DBInstanceIdentifier,Endpoint.Address]'
List Non Protected Databases (DeletionProtection)
aws rds describe-db-instances \
--query 'DBInstances[*].[DBInstanceIdentifier]' \
--output text \
| xargs -I {} bash -c 'if [[ $(aws rds describe-db-instances --db-instance-
identifier {} --query '"'"'DBInstances[*].DeletionProtection'"'"' --output text)
== False ]]; then echo {} ; fi'
Describe the Automated Backups for a DB Instance
aws rds describe-db-instance-automated-backups --db-instance-identifier
database-mysql
Create a DB Cluster
aws rds create-db-cluster \
--db-cluster-identifier mysql-cluster \
--engine aurora-mysql \
--engine-version 5.7.12 \
--master-username master \
--master-user-password xxxxxx \
--db-subnet-group-name default \
--vpc-security-group-ids sg-0130572b9daf3dc16
Create a DB Instance
aws rds create-db-instance \
--db-instance-identifier mysql-instance \
--db-instance-class db.t3.micro \
--engine mysql \
--master-username admin \
--master-user-password xxxxx \
--allocated-storage 40
Create a DB Security Group
aws rds create-db-security-group --db-security-group-name my-security-group --
db-security-group-description "My Security Group"
Create a Read Replica
aws rds create-db-instance-read-replica \
--db-instance-identifier test-instance-repl \
--source-db-instance-identifier test-instance
Create a Custom DB Cluster Endpoint
aws rds create-db-cluster-endpoint \
--db-cluster-endpoint-identifier mycustomendpoint \
--endpoint-type reader \
--db-cluster-identifier mydbcluster \
--static-members dbinstance1 dbinstance2
Apply Tag to a DB
aws rds add-tags-to-resource \
--resource-name arn:aws:rds:us-east-1:123456789012:db:database-mysql \
--tags "[{\"Key\": \"Name\",\"Value\": \"MyDatabase\"},{\"Key\":
\"Environment\",\"Value\": \"test\"}]"
Create a Cluster Snapshot
aws rds create-db-cluster-snapshot --db-cluster-identifier my-db-cluster --db-
cluster-snapshot-identifier my-db-cluster-snapshot
Create a CloudWatch Alarm for a DB Instance
e.g.: When average CPU for latest 15 minutes is above 90%
aws cloudwatch put-metric-alarm \
--alarm-name "my-alarm" \
--metric-name "CPUUtilization" \
--namespace "AWS/RDS" \
--statistic "Average" \
--period 300 \
--evaluation-periods 3 \
--threshold 90.0 \
--comparison-operator "GreaterThanOrEqualToThreshold" \
--dimensions "Name=DBInstanceIdentifier,Value=my-db-instance" \
--alarm-actions "<arn of sns resource>"
This will monitor the DB instance during a period of 300 seconds (5 minutes) during 3 evaluation
periods: 5*3 = 15 minutes.
If in the three periods, the average is equal or more than 90%, then the alarm will trigger the SNS
resource.
You should subscribe to the SNS resource you create by email or SMS.
Connect Deeper
This work was first published in Practical AWS course.
Join our online community FAUN and subscribe to our podcast The DevOps Fauncast.
Visit our publication The Chief I/O, subscribe to the newsletter and get cloud native insights from
our contributors.
