AWS commands

Sync local folder to S3

Uploads a local directory to an S3 bucket.

aws s3 sync ./my-folder s3://<bucket>

Add --delete to also remove objects that no longer exist locally. Try --dryrun first.

s3, sync, upload

Delete every object in an S3 bucket

Recursively deletes all objects in an S3 bucket.

Caution. Permanently deletes every object. Run it with --dryrun first. On a versioned bucket it only adds delete markers; the old versions stay and still cost money.

aws s3 rm s3://<bucket> --recursive

s3, delete

List running EC2 instances

Returns the ID, Type, and State of running EC2s.

aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" --query "Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name]" --output table

ec2, inventory

Check current AWS identity

Verifies which AWS IAM user/role you are currently authenticated as.

aws sts get-caller-identity

iam, auth, sts

Update EKS kubeconfig

Generates or updates kubeconfig for EKS.

aws eks update-kubeconfig --region <region> --name <cluster-name>

eks, kubernetes, auth

Log in with AWS SSO

Authenticates via AWS IAM Identity Center (SSO).

aws sso login --profile <profile-name>

sso, auth, login

Docker login to ECR

Gets a token and pipes it to docker login for AWS ECR.

aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <account_id>.dkr.ecr.<region>.amazonaws.com

ecr, docker, auth

Detect CloudFormation drift

Checks if actual resources have deviated from the CFN template.

aws cloudformation detect-stack-drift --stack-name <stack-name>

Returns a detection ID. Check the result with aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id <id>.

cloudformation, drift, iac

Generate S3 presigned URL

Creates a temporary URL (valid for 1 hour) to securely share an S3 object.

aws s3 presign s3://<bucket>/<key> --expires-in 3600

Anyone with the URL can download the object until it expires.

s3, presigned, share

Tail CloudWatch logs

Streams real-time logs from an AWS CloudWatch Log Group.

aws logs tail /aws/lambda/<function-name> --follow

cloudwatch, logs, lambda

Get a Secrets Manager value

Fetches the plain text value of a secret from AWS Secrets Manager.

aws secretsmanager get-secret-value --secret-id <secret-name> --query SecretString --output text

Prints the secret in plain text to your terminal.

secretsmanager, security, secrets

List stale IAM access keys

Lists all access keys for a user to identify old keys needing rotation.

aws iam list-access-keys --user-name <username>

iam, keys, security

Copy file to S3

Copies a single local file to an S3 bucket.

aws s3 cp local-file.txt s3://<bucket>/

s3, copy

Invoke Lambda function

Synchronously invokes a Lambda function from the CLI.

aws lambda invoke --function-name <function-name> --cli-binary-format raw-in-base64-out --payload '{}' response.json

AWS CLI v2 expects base64 payloads unless you pass --cli-binary-format raw-in-base64-out.

lambda, invoke

List RDS instances

Gets a list of all RDS database instances.

aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier,DBInstanceStatus]' --output table

rds, database

Stop EC2 instance

Stops a running EC2 instance by instance ID.

aws ec2 stop-instances --instance-ids <instance-id>

Data on instance store volumes is lost when the instance stops.

ec2, stop

Start EC2 instance

Starts a stopped EC2 instance.

aws ec2 start-instances --instance-ids <instance-id>

ec2, start

List Route53 hosted zones

Lists all DNS hosted zones in Route53.

aws route53 list-hosted-zones --output table

route53, dns

List load balancers

Lists all Application and Network Load Balancers.

aws elbv2 describe-load-balancers --query 'LoadBalancers[*].[LoadBalancerName,State.Code,DNSName]' --output table

elb, alb, nlb

Start SSM session

Opens a shell session to an EC2 instance via Systems Manager (no SSH key needed).

aws ssm start-session --target <instance-id>

Needs the Session Manager plugin for the AWS CLI and the SSM agent on the instance.

ssm, session, shell

Get monthly cost breakdown

Fetches cost and usage data grouped by service for the current month.

aws ce get-cost-and-usage --time-period Start=$(date +%Y-%m-01),End=$(date -d tomorrow +%Y-%m-%d) --granularity MONTHLY --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE

Each Cost Explorer API request costs $0.01. Uses GNU date; on macOS use gdate.

cost, billing, finops

List ECR images

Lists all images in an ECR repository sorted by push date.

aws ecr describe-images --repository-name <repo-name> --query 'sort_by(imageDetails,& imagePushedAt)[*].[imageTags[0],imagePushedAt]' --output table

ecr, images, docker

Send SQS message

Sends a test message to an SQS queue.

aws sqs send-message --queue-url <queue-url> --message-body '{"test": "hello"}'

sqs, queue, messaging

Scan DynamoDB table

Reads the first 10 items of a DynamoDB table.

aws dynamodb scan --table-name <table-name> --max-items 10

A scan reads the table page by page and consumes read capacity; avoid full scans on large tables.

dynamodb, nosql, scan

List CloudWatch alarms

Shows every CloudWatch alarm currently in the ALARM state.

aws cloudwatch describe-alarms --state-value ALARM --output table

cloudwatch, alarms, monitoring