Package: cpgaws
This package provides a unified command line interface to Amazon Web Services.The aws-cli package works on Python versions:3.8.x3.9.x3.10.x3.11.xAttention!We recommend that all customers regularly monitor theAmazon Web Services Security Bulletins websitefor any important security bulletins related to
aws-cli.Jump to:NoticesInstallationGetting StartedGetting HelpMore ResourcesNoticesOn 2024-06-20, support for macOS versions 10.14 and prior will be dropped.
To avoid disruption, customers using macOS 10.14 or prior
should upgrade to macOS 10.15 or later. For more information, please see
thisblog post.InstallationAWS CLI v2 can easily be installed on most standard platforms:MacOS pkg installerLinux x86-64 executable installerLinux arm64 (aarch64) executable installerWindows MSI installerYou can find more detailed installation instructionshere.If you want to run thev2development branch of the CLI, see the
“CLI Dev Version” section below.CLI ReleasesThe release notes for the AWS CLI can be foundhere.Command CompletionThe aws-cli package includes a very useful command completion feature.
This feature is not automatically installed so you need to configure it manually.
To enable tab completion for bash either use the built-in commandcomplete:$ complete -C aws_completer awsOr addbin/aws_bash_completerfile under/etc/bash_completion.d,/usr/local/etc/bash_completion.dor any otherbash_completion.dlocation.For tcsh:$ complete aws 'p/*/`aws_completer`/'You should add this to your startup scripts to enable it for future sessions.For zsh please refer tobin/aws_zsh_completer.sh.  Source that file, e.g.
from your~/.zshrc, and make sure you runcompinitbefore:$ source bin/aws_zsh_completer.shFor now the bash compatibility auto completion (bashcompinit) is used.
For further details please refer to the top ofbin/aws_zsh_completer.sh.Getting StartedBefore using aws-cli, you need to tell it about your AWS credentials.  You
can do this in several ways:Environment variablesShared credentials fileConfig fileIAM RoleThe quickest way to get started is to run theaws configurecommand:$ aws configure
AWS Access Key ID: foo
AWS Secret Access Key: bar
Default region name [us-west-2]: us-west-2
Default output format [None]: jsonTo use environment variables, do the following:$ export AWS_ACCESS_KEY_ID=<access_key>
$ export AWS_SECRET_ACCESS_KEY=<secret_key>To use the shared credentials file, create an INI formatted file like this:[default]
aws_access_key_id=foo
aws_secret_access_key=bar

[testing]
aws_access_key_id=foo
aws_secret_access_key=barand place it in~/.aws/credentials(or in%UserProfile%\.aws/credentialson Windows). If you wish to place the
shared credentials file in a different location than the one specified above,
you need to tell aws-cli where to find it.  Do this by setting
the appropriate environment variable:$ export AWS_SHARED_CREDENTIALS_FILE=/path/to/shared_credentials_fileTo use a config file, create a configuration file like this:[default]
aws_access_key_id=<default access key>
aws_secret_access_key=<default secret key>
# Optional, to define default region for this profile.
region=us-west-1

[profile testing]
aws_access_key_id=<testing access key>
aws_secret_access_key=<testing secret key>
region=us-west-2and place it in~/.aws/config(or in%UserProfile%\.aws\configon Windows). If you wish to place the config file in a different location than the one
specified above, you need to tell aws-cli where to find it.  Do this by setting
the appropriate environment variable:$ export AWS_CONFIG_FILE=/path/to/config_fileAs you can see, you can have multipleprofilesdefined in both the shared
credentials file and the  configuration file. You can then specify which
profile to use by using the--profileoption. If no profile is specified
thedefaultprofile is used.In the config file, except for the default profile, youmustprefix each config section of a profile group withprofile.
For example, if you have a profile named “testing” the section header would
be[profile testing].The final option for credentials is highly recommended if you are
using aws-cli on an EC2 instance.  IAM Roles are
a great way to have credentials installed automatically on your
instance.  If you are using IAM Roles, aws-cli will find them and use
them automatically.Other Configurable VariablesIn addition to credentials, a number of other variables can be
configured either with environment variables, configuration file
entries or both.  The following table documents these.VariableOptionConfig EntryEnvironment VariableDescriptionprofile–profileprofileAWS_PROFILEDefault profile nameregion–regionregionAWS_DEFAULT_REGIONDefault AWS Regionconfig_fileAWS_CONFIG_FILEAlternate location of configcredentials_fileAWS_SHARED_CREDENTIALS_FILEAlternate location of credentialsoutput–outputoutputAWS_DEFAULT_OUTPUTDefault output styleca_bundle–ca-bundleca_bundleAWS_CA_BUNDLECA Certificate Bundleaccess_keyaws_access_key_idAWS_ACCESS_KEY_IDAWS Access Keysecret_keyaws_secret_access_keyAWS_SECRET_ACCESS_KEYAWS Secret Keytokenaws_session_tokenAWS_SESSION_TOKENAWS Token (temp credentials)cli_timestamp_formatcli_timestamp_formatOutput format of timestampsmetadata_service_timeoutmetadata_service_timeoutAWS_METADATA_SERVICE_TIMEOUTEC2 metadata timeoutmetadata_service_num_attemptsmetadata_service_num_attemptsAWS_METADATA_SERVICE_NUM_ATTEMPTSEC2 metadata retry countparameter_validationparameter_validationToggles local parameter validationExamplesIf you get tired of specifying a--regionoption on the command line
all of the time, you can specify a default region to use whenever no
explicit--regionoption is included using theregionvariable.
To specify this using an environment variable:$ export AWS_DEFAULT_REGION=us-west-2To include it in your config file:[default]
aws_access_key_id=<default access key>
aws_secret_access_key=<default secret key>
region=us-west-1Similarly, theprofilevariable can be used to specify which profile to use
if one is not explicitly specified on the command line via the--profileoption.  To set this via environment variable:$ export AWS_PROFILE=testingTheprofilevariable can not be specified in the configuration file
since it would have to be associated with a profile and would defeat the
purpose.Further InformationFor more information about configuration options, please refer theAWS CLI Configuration Variables topic. You can access this topic
from the CLI as well by runningaws helpconfig-vars.Accessing Services With Global EndpointsSome services, such asAWS Identity and Access Management(IAM)
have a single, global endpoint rather than different endpoints for
each region.To make access to these services simpler, aws-cli will automatically
use the global endpoint unless you explicitly supply a region (using
the--regionoption) or a profile (using the--profileoption).
Therefore, the following:$ aws iam list-userswill automatically use the global endpoint for the IAM service
regardless of the value of theAWS_DEFAULT_REGIONenvironment
variable or theregionvariable specified in your profile.JSON Parameter InputMany options that need to be provided are simple string or numeric
values.  However, some operations require JSON data structures
as input parameters either on the command line or in files.For example, consider the command to authorize access to an EC2
security group.  In this case, we will add ingress access to port 22
for all IP addresses:$ aws ec2 authorize-security-group-ingress --group-name MySecurityGroup \
  --ip-permissions '{"FromPort":22,"ToPort":22,"IpProtocol":"tcp","IpRanges":[{"CidrIp": "0.0.0.0/0"}]}'File-based Parameter InputSome parameter values are so large or so complex that it would be easier
to place the parameter value in a file and refer to that file rather than
entering the value directly on the command line.Let’s use theauthorize-security-group-ingresscommand shown above.
Rather than provide the value of the--ip-permissionsparameter directly
in the command, you could first store the values in a file.  Let’s call
the fileip_perms.json:{"FromPort":22,
 "ToPort":22,
 "IpProtocol":"tcp",
 "IpRanges":[{"CidrIp":"0.0.0.0/0"}]}Then, we could make the same call as above like this:$ aws ec2 authorize-security-group-ingress --group-name MySecurityGroup \
    --ip-permissions file://ip_perms.jsonThefile://prefix on the parameter value signals that the parameter value
is actually a reference to a file that contains the actual parameter value.
aws-cli will open the file, read the value and use that value as the
parameter value.This is also useful when the parameter is really referring to file-based
data.  For example, the--user-dataoption of theaws ec2run-instancescommand or the--public-key-materialparameter of theaws ec2import-key-paircommand.Command OutputThe default output for commands is currently JSON.  You can use the--queryoption to extract the output elements from this JSON document.
For more information on the expression language used for the--queryargument, you can read theJMESPath Tutorial.ExamplesGet a list of IAM user names:$ aws iam list-users --query Users[].UserNameGet a list of key names and their sizes in an S3 bucket:$ aws s3api list-objects --bucket b --query Contents[].[Key,Size]Get a list of all EC2 instances and include their Instance ID, State Name,
and their Name (if they’ve been tagged with a Name):$ aws ec2 describe-instances --query \
  'Reservations[].Instances[].[InstanceId,State.Name,Tags[?Key==`Name`] | [0].Value]'You may also find thejqtool useful in
processing the JSON output for other uses.There is also an ASCII table format available.  You can select this style with
the--outputtableoption or you can make this style your default output
style via environment variable or config file entry as described above.
Try adding--outputtableto the above commands.CLI Dev VersionIf you are just interested in using the latest released version of the AWS CLI,
please see theInstallationsection above.  This section is for anyone who
wants to install the development version of the CLI.  You normally would not
need to do this unless:You are developing a feature for the CLI and plan on submitting a Pull
Request.You want to test the latest changes of the CLI before they make it into an
official release.The latest changes to the CLI are in thev2branch on github.  This isNOTthe default branch when you clone the git repository, so you’ll need
to make sure yougit checkout v2.If you just want to install a snapshot of the latest development version of
the CLI, you can use therequirements.txtfile included in this repo.
This file points to the development version of our dependencies:$ cd <path_to_awscli> && git checkout v2
$ pip install -r requirements.txt
$ pip install -e .Verify that the AWS CLI is correctly installed. Note that the wordsourceshould appear in the output:$ aws --version
aws-cli/2.2.30 Python/3.8.11 Darwin/20.4.0 source/x86_64 prompt/offGenerate the autocompletion index:$ ./scripts/gen-ac-index --include-builtin-indexVerify the autocompletion index is generated by entering auto-prompt mode:$ aws --cli-auto-promptGetting HelpThe best way to interact with our team is through GitHub. You canopen
an issueand
choose from one of our templates for guidance, bug reports, or feature
requests.You may find help from the community onStack
Overflowwith the tagaws-clior on
theAWS Discussion Forum for
CLI. If you
have a support plan withAWS Premium
Support, you can also create
a new support case.Please check for open similarissuesbefore opening
another one.The AWS CLI implements AWS service APIs. For general issues regarding
the services or their limitations, you may find theAmazon Web Services
Discussion Forumshelpful.More ResourcesChangelogAWS CLI
DocumentationAWS CLI User
GuideAWS CLI Command
ReferenceAmazon Web Services Discussion
ForumsAWS Support