aws cli

Print awscli version (v2.x).

Top-level help — list service groups and basic usage.

Show commands for one service.

<service> help; aws <service> <command> help

Show every flag + parameter for a single API call.

Print a JSON skeleton with every required / optional field for a command — paste back as your input.

--generate-cli-skeleton <input|output>; --cli-input-json <file>; --cli-input-yaml <file>

Interactive wizard — sets access key, secret, output format, region in `~/.aws/credentials` and `~/.aws/config`.

Same as `aws configure` but writes to a named profile.

--profile dev; --profile prod; --no-prompt

Read a single value out of the active config.

default.region; default.output; <key>; --profile <name>

Set a single config value.

<key> <value>; --profile <name>

Show the active configuration (profile, region, access-key id, secret redacted).

Launch the SSO device-flow login (or browser redirect). Sets short-lived credentials for the profile.

--profile dev; --no-browser; --use-device-code

Configure an SSO profile interactively (start URL, region, account, role).

Print the IAM principal (account / arn / user-id) for the active credentials — sanity-check after configuring.

--profile <name>; --no-verify-ssl; --endpoint-url <url>

Switch to an IAM role, getting temporary credentials — useful for cross-account access.

--role-arn; --role-session-name; --external-id; --mfa-serial <arn>; --serial-number <arn>; --token-code <mfa>

Choose output format: `json` (default), `text`, `table`. Combine with `--query` for jq-like projection.

json; text; table; yaml; yaml-stream

Project the response with a JMESPath expression (jq-like).

--query 'Reservations[].Instances[].InstanceId'; --query 'Reservations[].Instances[].[InstanceId,State.Name]'

Disable auto-pagination — return the first page only (faster; useful when you only want a count).

Read input parameters as base64 — needed for binary params like `--zip-file fileb://lambda.zip`.

raw-in-base64-out; base64

List every EC2 instance with full detail.

--instance-ids i-xxx; --filters Name=tag:Name,Values=prod; --query; --output

Start one or more stopped instances.

--instance-ids i-xxx i-yyy

Stop one or more running instances (without terminating).

Create a new SSH key pair and save the private key to a `.pem` file with the right permissions.

List buckets (without args) or files under a prefix.

s3://<bucket>/<prefix>; --recursive; --human-readable; --summarize

Upload or copy a file. `s3://...` can be source or destination.

--recursive; --exclude '*'; --include '*.log'; --storage-class STANDARD|GLACIER|...; --acl public-read

Two-way S3 directory sync (uploads new / changed files, deletes destination-side extras unless `--delete` is passed).

--delete; --exclude; --include; --no-progress; --exact-timestamps

Make a new S3 bucket. Region defaults to us-east-1; pass `--region` to override.

--region eu-west-1

Remove bucket (use `--force` to wipe objects first).

--force; --no-progress

Generate a presigned URL that expires after `<seconds>` — useful for sharing private files.

List every Lambda function in the current region.

--function-version ALL; --max-items 50; --query 'Functions[].FunctionName'

Update a function's code from a local zip. Use `--cli-binary-format raw-in-base64-out` on some setups.

Invoke a function synchronously — write the response to `out.json`.

--invocation-type Event|RequestResponse|DryRun; --log-type Tail; --cli-binary-format

Scan a DynamoDB table — reads every item (use `query` with a key condition when possible).

--table-name; --filter-expression; --projection-expression; --select; --max-items

Query items by partition key with a key condition expression.

List every IAM user in the account.

--path-prefix /; --max-items

Create a new IAM user.

Attach a managed policy to a user.

Run any command under a named profile (must already be configured).

--profile prod; --profile dev; --profile staging

Set the profile via environment variable — useful in scripts.

Dump HTTP wire-level logs to stderr — useful when diagnosing signing or payload errors.

--debug; --no-verify-ssl; --ca-bundle <file>; --cli-read-timeout <seconds>

Make unsigned requests — useful against public buckets / test endpoints.