AWS — cheat sheet
A one-page lookup for the AWS CLI commands used across this course. Grouped by task; the course pages
cover the why behind each choice — this page is just the what.
Identity & credentials
| Task |
Command |
| Show the identity (account, ARN) behind the active credentials |
aws sts get-caller-identity |
| Assume a role and print temporary credentials |
aws sts assume-role --role-arn <arn> --role-session-name <name> |
| List configured CLI profiles |
aws configure list-profiles |
| Use a named profile for one command |
aws <command> --profile <name> |
VPC & networking
| Task |
Command |
| List VPCs |
aws ec2 describe-vpcs |
| List subnets (optionally filtered by VPC) |
aws ec2 describe-subnets --filters Name=vpc-id,Values=<vpc-id> |
| List route tables |
aws ec2 describe-route-tables |
| List security groups |
aws ec2 describe-security-groups |
| Show an instance's network detail (ENI, public/private IP) |
aws ec2 describe-instances --instance-ids <id> |
Compute — EC2 & Auto Scaling
| Task |
Command |
| List instances |
aws ec2 describe-instances |
| Start / stop / terminate an instance |
aws ec2 start-instances / stop-instances / terminate-instances --instance-ids <id> |
| Describe an Auto Scaling group |
aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names <name> |
| Change desired capacity |
aws autoscaling set-desired-capacity --auto-scaling-group-name <name> --desired-capacity <n> |
EKS — cluster & nodes
| Task |
Command |
| List clusters |
aws eks list-clusters |
| Describe a cluster (endpoint, version, status) |
aws eks describe-cluster --name <cluster> |
| Write/update the local kubeconfig for a cluster |
aws eks update-kubeconfig --name <cluster> |
| List node groups |
aws eks list-nodegroups --cluster-name <cluster> |
Create a cluster with eksctl (wraps CloudFormation) |
eksctl create cluster --name <cluster> |
S3
| Task |
Command |
| List buckets |
aws s3 ls |
| List objects in a bucket/prefix |
aws s3 ls s3://<bucket>/<prefix>/ |
Copy a local file/dir to S3 (--recursive for a dir) |
aws s3 cp <path> s3://<bucket>/<key> --recursive |
| Sync a local dir with a bucket |
aws s3 sync <path> s3://<bucket>/<prefix>/ |
| Remove an object |
aws s3 rm s3://<bucket>/<key> |
| Lower-level object API (metadata, versioning, multipart, …) |
aws s3api <subcommand> |
IAM
| Task |
Command |
| List roles / policies / users |
aws iam list-roles / list-policies / list-users |
| Show a role, including its trust policy |
aws iam get-role --role-name <name> |
| Show a policy's current document |
aws iam get-policy-version --policy-arn <arn> --version-id <v> |
| Attach a managed policy to a role |
aws iam attach-role-policy --role-name <name> --policy-arn <arn> |
| Simulate whether a principal can take an action (policy evaluation, no side effects) |
aws iam simulate-principal-policy --policy-source-arn <arn> --action-names <action> |
RDS & DynamoDB
| Task |
Command |
| List RDS instances |
aws rds describe-db-instances |
| Trigger a manual RDS snapshot |
aws rds create-db-snapshot --db-instance-identifier <id> --db-snapshot-identifier <snap> |
| List DynamoDB tables |
aws dynamodb list-tables |
| Read one item by key |
aws dynamodb get-item --table-name <table> --key <json> |
CloudWatch & CloudTrail
| Task |
Command |
| Get a metric's datapoints |
aws cloudwatch get-metric-statistics --namespace <ns> --metric-name <name> --start-time <t> --end-time <t> --period <s> --statistics Average |
| Filter/tail log events |
aws logs filter-log-events --log-group-name <group> |
| List recent account-activity events |
aws cloudtrail lookup-events |
| Task |
Command |
| Create or update a stack from a template |
aws cloudformation deploy --template-file <file> --stack-name <name> |
| Preview changes before applying (a change set) |
aws cloudformation create-change-set --stack-name <name> --template-body file://<file> |
| List stacks and their status |
aws cloudformation describe-stacks |
| Delete a stack |
aws cloudformation delete-stack --stack-name <name> |
Route 53
| Task |
Command |
| List hosted zones |
aws route53 list-hosted-zones |
| List records in a zone |
aws route53 list-resource-record-sets --hosted-zone-id <id> |
How this connects
The networking page covers the IGW/NAT/route-table mechanics behind the VPC commands above, the
compute page covers the EKS control-plane/data-plane split, the storage & data page covers the S3/EBS/EFS
and DynamoDB/RDS trade-offs, and the IAM & security page covers the policy-evaluation order these
iam/sts commands enforce.