Command Palette

Search for a command to run...

GitHubGitHub

AWS CLI Installation Guide

Install AWS CLI v2 on Linux, macOS and Windows with the signed install script, authenticate with IAM Identity Center or SSO, and automate AWS from your terminal.

The AWS Command Line Interface is the unified tool for managing AWS services from a terminal or a script. Version 2 is a self-contained binary — it bundles its own Python runtime, so you do not need Python installed.

System Requirements

  • A 64-bit operating system: Linux (x86_64 or ARM), macOS 11+, or 64-bit Windows
  • No Python required — version 2 bundles its own interpreter
  • glibc, groff and less on Linux (present by default on most distributions)
  • An AWS account and a way to authenticate: IAM Identity Center, an IAM user, or a role

Installation Instructions

Linux (x86_64 and ARM)

The install script is the recommended method. It verifies the download and installs for the current user by default:

# Install for the current user (into $HOME/.local)
curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bash
 
# Install for all users (into /usr/local) — needs sudo
curl -fsSL https://awscli.amazonaws.com/v2/install.sh | sudo bash -s -- --system
 
# Verify
aws --version

Verify the script before you run it (optional)

The script is signed with a PGP key, so you can check it first:

# Download the script and its signature
curl -fsSL https://awscli.amazonaws.com/v2/install.sh -o install.sh
curl -fsSL https://awscli.amazonaws.com/v2/install.sh.sig -o install.sh.sig
 
# Import the AWS CLI public key and verify
gpg --import <(curl -fsSL https://awscli.amazonaws.com/v2/install.sh.asc)
gpg --verify install.sh.sig install.sh
 
# Then install
bash install.sh

The signing key fingerprint is FB5D B77F D5C1 18B8 0511 ADA8 A631 0ACC 4672 475C.

Command line installer (for version pinning)

Use this if you need a specific version, because the install script always fetches the latest release:

# Download and unzip
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
 
# Install (defaults: /usr/local/aws-cli and /usr/local/bin)
sudo ./aws/install
 
# Verify and clean up
aws --version
rm -rf aws awscliv2.zip

On ARM64, use awscli-exe-linux-aarch64.zip instead.

Snap package

sudo snap install aws-cli --classic

Snap keeps the CLI up to date automatically, but you cannot pin a minor version.

Verifying the Installation

# Version and build information
aws --version
 
# Confirm you can reach AWS and who you are
aws sts get-caller-identity
 
# List the services you can call
aws help

Authentication

IAM Identity Center (formerly AWS SSO)

The recommended way to give people access — no long-lived keys, and access is tied to your identity provider.

# Start the SSO login and open the browser
aws sso login --profile my-profile
 
# Then use the profile
aws s3 ls --profile my-profile

Or let the CLI guide you through it interactively:

aws configure sso

Named profiles with static credentials

# Create a profile
aws configure --profile production
 
aws configure list-profiles
aws s3 ls --profile production

Roles and temporary credentials

# Assume a role and export the temporary credentials
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/deploy \
  --role-session-name my-session
 
# Or use a credential process in ~/.aws/config
[profile deploy]
region = eu-central-1
role_arn = arn:aws:iam::123456789012:role/deploy
source_profile = default
credential_process = aws --profile default sts assume-role --role-arn arn:aws:iam::123456789012:role/deploy --role-session-name gcloud --duration-seconds 3600

Service accounts for automation

# Never use a long-lived key in CI — use OIDC instead
# GitHub Actions
- uses: aws-actions/configure-aws-credentials@v6
  with:
    role-to-assume: arn:aws:iam::123456789012:role/gha-deploy

Configuration Files

# ~/.aws/config
[default]
region = eu-central-1
output = json
 
[profile dev]
region = us-east-1
output = text
cli_pager =
 
[profile prod]
region = eu-west-1
output = json
# ~/.aws/credentials
[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY
 
[prod]
aws_access_key_id = PROD_ACCESS_KEY
aws_secret_access_key = PROD_SECRET_KEY
# Change a setting without the interactive prompt
aws configure set region us-west-2 --profile prod
aws configure set output json --profile prod
 
# Turn off the pager for scripted output
export AWS_PAGER=""

Everyday Commands

S3

# List buckets
aws s3 ls
 
# Copy a file up and down
aws s3 cp file.txt s3://my-bucket/
aws s3 cp s3://my-bucket/file.txt ./
 
# Sync a directory (only changed files)
aws s3 sync ./local s3://my-bucket/dir/ --delete
 
# Large transfers: use the S3 Transfer tools
aws s3 cp ./big-dir s3://my-bucket/ --recursive --no-progress

EC2

# List instances
aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId' --output text
 
# Start and stop
aws ec2 start-instances --instance-ids i-1234567890abcdef0
aws ec2 stop-instances --instance-ids i-1234567890abcdef0
 
# Run a command on an instance through SSM
aws ssm send-command --instance-ids i-1234567890abcdef0 --document-name AWS-RunShellScript \
  --parameters 'commands=["uptime"]'

Handy one-liners

# Who am I?
aws sts get-caller-identity
 
# The last 20 CloudTrail entries
aws cloudtrail lookup-events --max-results 20 \
  --query 'Events[].{Time:EventTime,Event:EventName,User:Username}'
 
# Tail the logs of a Lambda function
aws logs tail /aws/lambda/my-function --follow

Upgrading

# If you installed with the install script or an official installer
aws update
# If you installed with the command line installer, replace the binary
sudo ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update

Troubleshooting

Best Practices

  1. Use IAM Identity Center or OIDC instead of long-lived access keys.
  2. Use named profiles per environment and pass --profile explicitly in scripts.
  3. Never commit credentials — keep ~/.aws/credentials out of version control and restrict its permissions with chmod 600.
  4. Use --output json in automation and parse with jq.
  5. Pin the CLI version in CI images so a new release cannot change your pipeline.
  6. Enable CloudTrail and Config so every API call is recorded.
  7. Use aws s3api when you need exact control over the request the API receives.
  8. Prefer the S3 Transfer tools (aws s3 cp --recursive) for large data movement.

Next Steps

Overview

Install and configure the AWS, Azure and Google Cloud command line tools with authentication, profiles, completion and multi-account workflows for every major cloud provider.

Google Cloud CLI

Install the Google Cloud CLI 590 on Linux, macOS and Windows, authenticate with IAM, manage configurations and automate Google Cloud with gcloud.