AWS CLI Basics

Configuration has precedence

The AWS CLI syntax is aws <service> <command> [options], for example aws s3 ls or aws ec2 describe-instances. aws configure writes credentials to ~/.aws/credentials and Region/output settings to ~/.aws/config. Named profiles separate environments and are selected with --profile or AWS_PROFILE.

flowchart LR
  P["Profile dev<br/>or IAM role"] --> C["AWS CLI v2"]
  R["Region<br/>ap-southeast-1"] --> C
  O["Output<br/>json, text, table"] --> C
  C --> API["AWS API<br/>signed request"]
  API --> Q["--query<br/>pick fields"]
  %% step P: Credentials come from the selected profile, environment variables or an attached role.
  %% step R: Regional commands need a Region from --region, AWS_REGION or the profile.
  %% step O: --output only changes how results are printed.
  %% step C: The CLI combines these settings and signs the request.
  %% step API: The service answers in JSON.
  %% step Q: --query (JMESPath) filters the answer on your side before printing.

Files and profiles

# ~/.aws/config
[default]
region = ap-southeast-1
output = json

[profile dev]
region = ap-southeast-1

# ~/.aws/credentials
[dev]
aws_access_key_id = AKIA...
aws_secret_access_key = ...

In config, non-default sections are written [profile dev]; in credentials they are just [dev]. Create a profile with aws configure --profile dev. Settings resolve in this order: command-line option, environment variable, profile file.

On EC2 with an IAM role, do not run aws configure to store static keys: static credentials can take precedence and lose automatic rotation. If a regional command gets no Region from an option, environment, or profile, the CLI asks you to specify one.

Reading output

Most commands return JSON. Three tools make it usable:

• --output table or text for people and shell scripts.
• --query to select fields, for example --query "Reservations[].Instances[].[InstanceId,State.Name]".
• --filters to let the service filter before sending, for example --filters Name=instance-state-name,Values=running.

--filters reduces what AWS returns; --query only trims what is printed. Large results are paginated automatically; --max-items limits them.

Safe habits

• Run aws sts get-caller-identity to confirm the account and principal before you change anything.
• Many commands support --dry-run (EC2) to check permissions without making changes.
• aws <service> help or aws <service> <command> help shows every option.
• Install AWS CLI version 2; version 1 is legacy.
• Turn on auto-prompt with aws --cli-auto-prompt when you are learning the parameters.

--output changes presentation, not the Region.

Traps: writing [profile dev] in the credentials file; expecting --output to change the Region; forgetting which profile is active and changing the wrong account.