AWS CLI Cheatsheet

Real commands and --query patterns for EC2, Lambda, networking, and Route 53 — the services this covers best. IAM and S3 CLI usage aren’t covered here (see note at the bottom). For the full explanations, see the AWS guides.

EC2

# Launch an instance
aws ec2 run-instances \
  --image-id ami-0c02fb55956c7d316 \
  --instance-type t3.medium \
  --key-name my-keypair \
  --security-group-ids sg-0abc123def456 \
  --subnet-id subnet-0a1b2c3d \
  --iam-instance-profile Name=AppServerProfile \
  --user-data file://startup.sh \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-1}]'

# Burstable instance in unlimited (no CPU-credit throttling) mode
aws ec2 run-instances \
  --instance-type t3.medium \
  --image-id ami-0c02fb55956c7d316 \
  --credit-specification '{"CpuCredits":"unlimited"}'

# Reserved Instance offerings lookup
aws ec2 describe-reserved-instances-offerings \
  --instance-type m5.large \
  --product-description "Linux/UNIX" \
  --offering-class standard \
  --query 'ReservedInstancesOfferings[?Duration==`31536000`].[OfferingType,RecurringCharges]' \
  --output table

# Spot Fleet across instance types and AZs
aws ec2 create-fleet \
  --type maintain \
  --target-capacity-specification TotalTargetCapacity=10,DefaultTargetCapacityType=spot \
  --launch-template-configs '[
    {"LaunchTemplateSpecification": {"LaunchTemplateName": "my-template", "Version": "$Latest"},
     "Overrides": [
       {"InstanceType": "m5.large",  "SubnetId": "subnet-1a"},
       {"InstanceType": "m5a.large", "SubnetId": "subnet-1a"}
     ]}
  ]' \
  --spot-options AllocationStrategy=diversified

Elastic IP (best real `--query` examples in the corpus)

# Allocate and read back the allocation ID / public IP with jq
EIP_INFO=$(aws ec2 allocate-address --domain vpc --output json)
EIP_ALLOC=$(echo $EIP_INFO | jq -r '.AllocationId')
EIP_ADDR=$(echo $EIP_INFO | jq -r '.PublicIp')

# Associate with a running instance
aws ec2 associate-address --instance-id i-0abc123 --allocation-id $EIP_ALLOC

# Verify the association
aws ec2 describe-addresses \
  --allocation-ids $EIP_ALLOC \
  --query 'Addresses[0].[PublicIp,InstanceId,AssociationId]' \
  --output table

# Disassociate
ASSOC_ID=$(aws ec2 describe-addresses --allocation-ids $EIP_ALLOC \
  --query 'Addresses[0].AssociationId' --output text)
aws ec2 disassociate-address --association-id $ASSOC_ID

# Find unassociated EIPs (the ones costing you money) and release
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==`null`].[AllocationId,PublicIp]' \
  --output table
aws ec2 release-address --allocation-id $EIP_ALLOC

# Count allocations in a region — JMESPath length() function
aws ec2 describe-addresses --query 'length(Addresses)' --output text

Lambda

# Create from a zip package
zip function.zip lambda_function.py
aws lambda create-function \
  --function-name process-orders \
  --runtime python3.12 \
  --role arn:aws:iam::123456789012:role/lambda-exec-role \
  --handler lambda_function.lambda_handler \
  --zip-file fileb://function.zip \
  --memory-size 256 \
  --timeout 30 \
  --environment Variables='{TABLE_NAME=orders,REGION=us-east-1}'

# Deploy as a container image (supports up to 10 GB)
aws lambda create-function \
  --function-name ml-inference \
  --package-type Image \
  --code ImageUri=123456789012.dkr.ecr.us-east-1.amazonaws.com/ml-model:latest \
  --role arn:aws:iam::123456789012:role/lambda-exec-role \
  --memory-size 3008 \
  --timeout 60

# Allow another service (e.g. S3) to invoke the function
aws lambda add-permission \
  --function-name doc-processor \
  --statement-id s3-trigger \
  --action lambda:InvokeFunction \
  --principal s3.amazonaws.com \
  --source-arn arn:aws:s3:::my-upload-bucket

# Attach a layer, or update VPC config
aws lambda update-function-configuration \
  --function-name my-function \
  --layers arn:aws:lambda:us-east-1:123456789:layer:pandas-layer:1

aws lambda update-function-configuration \
  --function-name api-handler \
  --vpc-config SubnetIds=subnet-0a1b2c,subnet-0d4e5f,SecurityGroupIds=sg-lambda-outbound

Lambda concurrency

# Reserved concurrency: set / check / remove
aws lambda put-function-concurrency --function-name payment-processor --reserved-concurrent-executions 100
aws lambda get-function-concurrency --function-name payment-processor
aws lambda delete-function-concurrency --function-name payment-processor

# Provisioned concurrency on a published version
VERSION=$(aws lambda publish-version --function-name api-handler --query 'Version' --output text)
aws lambda put-provisioned-concurrency-config \
  --function-name api-handler --qualifier $VERSION --provisioned-concurrent-executions 10

# ...or on an alias
aws lambda create-alias --function-name api-handler --name prod --function-version $VERSION
aws lambda put-provisioned-concurrency-config \
  --function-name api-handler --qualifier prod --provisioned-concurrent-executions 10

# Monitor concurrent executions
aws cloudwatch get-metric-statistics \
  --namespace AWS/Lambda --metric-name ConcurrentExecutions --statistics Maximum \
  --period 60 --start-time 2024-01-15T00:00:00Z --end-time 2024-01-15T01:00:00Z

DynamoDB Streams → Lambda

aws dynamodb update-table --table-name orders \
  --stream-specification StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES

STREAM_ARN=$(aws dynamodb describe-table --table-name orders \
  --query 'Table.LatestStreamArn' --output text)

aws lambda create-event-source-mapping \
  --function-name audit-logger --event-source-arn $STREAM_ARN \
  --starting-position LATEST --batch-size 100

Networking, Route 53, Auto Scaling

# Route 53: create a hosted zone and read its ID
ZONE_ID=$(aws route53 create-hosted-zone \
  --name example.com --caller-reference "$(date +%s)" \
  --query 'HostedZone.Id' --output text)

aws route53 change-resource-record-sets \
  --hosted-zone-id $ZONE_ID \
  --change-batch file://record-changes.json

# Auto Scaling: launch template + group + scaling policy
aws ec2 create-launch-template --launch-template-name web-lt --launch-template-data file://lt.json
aws autoscaling create-auto-scaling-group \
  --auto-scaling-group-name web-asg \
  --launch-template LaunchTemplateName=web-lt,Version='$Latest' \
  --min-size 2 --max-size 10 --desired-capacity 3 \
  --vpc-zone-identifier "subnet-1a,subnet-1b"
aws autoscaling put-scaling-policy \
  --auto-scaling-group-name web-asg --policy-name scale-up --scaling-adjustment 2 --adjustment-type ChangeInCapacity

# EKS: create cluster and node group
aws eks create-cluster --name my-cluster --role-arn arn:aws:iam::123456789012:role/eks-role --resources-vpc-config subnetIds=subnet-1a,subnet-1b
aws eks update-kubeconfig --name my-cluster
aws eks create-nodegroup --cluster-name my-cluster --nodegroup-name workers --subnets subnet-1a subnet-1b --node-role arn:aws:iam::123456789012:role/node-role

Flags & —query notes

Flag	Purpose
`--query '<jmespath>'`	Filter/reshape the response before it prints
`--output table \| text \| json`	Output format — `text` is ideal for capturing a single value into a shell variable
`--region <region>`	Override the default region for one call

JMESPath patterns actually used above

Pattern	Example
Field path	`Table.LatestStreamArn`
Array projection (pick columns)	`Addresses[0].[PublicIp,InstanceId,AssociationId]`
Filter expression	Addresses[?AssociationId==`null`]
Function call	`length(Addresses)`

S3 (limited coverage in source content)

aws s3 cp local.txt s3://my-demo-bucket/encrypted.txt --sse AES256
aws s3 cp local.txt s3://my-kms-bucket/kms-file.txt --sse aws:kms

aws s3api put-object \
  --bucket my-ssec-bucket --key secret.txt --body local.txt \
  --sse-customer-algorithm AES256 --sse-customer-key fileb://my_key.bin

Not covered: IAM CLI (create-role, attach-role-policy, etc.) and STS don’t appear anywhere in our source guides — IAM only shows up as inline JSON policy documents attached to other services. aws s3 sync and aws s3 ls also aren’t documented in our current content. If you need these, the official AWS CLI reference is the best source until we add dedicated guides.