AWS CLI v2 Cheatsheet: S3, EC2, IAM, Lambda and JMESPath

# install (macOS — Homebrew)
brew install awscli

# install (Linux — official bundle, recommended for v2)
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip && sudo ./aws/install

# verify
aws --version          # aws-cli/2.x.x Python/3.x …

# classic long-lived keys
aws configure                                      # writes ~/.aws/credentials + ~/.aws/config
aws configure --profile prod                       # named profile

# SSO (preferred for orgs)
aws configure sso                                  # browser-based device flow
aws sso login --profile prod                       # refresh expired token

# env overrides (beat ~/.aws/*)
export AWS_PROFILE=prod
export AWS_REGION=us-east-1
export AWS_PAGER=""                                # disable the less pager

# --query is client-side JMESPath, but skips the noise.

# one field
aws ec2 describe-instances \
  --query 'Reservations[].Instances[].InstanceId'

# table of {Id, State, Type, Name-tag}
aws ec2 describe-instances \
  --query 'Reservations[].Instances[].{Id:InstanceId, State:State.Name, Type:InstanceType, Name:Tags[?Key==`Name`]|[0].Value}' \
  --output table

# filter by tag, then project
aws ec2 describe-instances \
  --filters 'Name=tag:Env,Values=prod' \
  --query 'Reservations[].Instances[?State.Name==`running`].InstanceId' \
  --output text

# bucket names only
aws s3api list-buckets --query 'Buckets[].Name' --output text

# assume a role from one account into another — capture the temp creds
CREDS=$(aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/Deployer \
  --role-session-name ci-deploy \
  --duration-seconds 3600 \
  --query 'Credentials' --output json)

export AWS_ACCESS_KEY_ID=$(echo "$CREDS" | jq -r .AccessKeyId)
export AWS_SECRET_ACCESS_KEY=$(echo "$CREDS" | jq -r .SecretAccessKey)
export AWS_SESSION_TOKEN=$(echo "$CREDS" | jq -r .SessionToken)

# verify identity
aws sts get-caller-identity

# live tail (follow), last 10 min
aws logs tail /aws/lambda/my-fn --since 10m --follow

# filter by pattern (case-sensitive substring or metric filter syntax)
aws logs tail /aws/lambda/my-fn --since 1h --filter-pattern 'ERROR'

# multiple streams, JSON output for piping
aws logs tail /aws/ecs/my-svc --format json --since 30m | jq '.message'

# one-shot query via Logs Insights
QUERY_ID=$(aws logs start-query \
  --log-group-name /aws/lambda/my-fn \
  --start-time $(date -v-1H +%s) --end-time $(date +%s) \
  --query-string 'fields @timestamp, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 50' \
  --query queryId --output text)

aws logs get-query-results --query-id "$QUERY_ID"

# end-to-end: ship a static site to S3 + invalidate CloudFront
BUCKET=my-site-prod
DIST_ID=E1ABCDXYZ12345
REGION=us-east-1

# 1) sync the build (delete removed files, set cache headers)
aws s3 sync ./dist "s3://$BUCKET" \
  --delete \
  --cache-control "public, max-age=31536000, immutable" \
  --exclude "index.html"

# 2) re-upload index.html with a short TTL so updates roll out fast
aws s3 cp ./dist/index.html "s3://$BUCKET/index.html" \
  --cache-control "public, max-age=60"

# 3) bust CloudFront edge cache
aws cloudfront create-invalidation \
  --distribution-id "$DIST_ID" \
  --paths "/*"

# 4) tail Lambda@Edge logs (optional)
aws logs tail "/aws/lambda/us-east-1.my-edge-fn" --since 5m --follow