AWS CLI and SDK

The AWS Command Line Interface (CLI) and the AWS Software Development Kit (SDK) let you control AWS without clicking through the web console. The CLI accepts typed commands in a terminal. The SDK lets programs written in Python, JavaScript, Java, or C# talk to AWS services directly.

Picture the AWS Management Console as ordering food by pointing at a printed menu. The CLI works like placing the same order by phone with a ready script. The SDK works like hiring an assistant who places orders automatically whenever your application needs them.

Console, CLI, and SDK Compared

All three tools send requests to the same AWS service endpoints. Only the way you give instructions changes.

        You (Learner or Developer)
               |
   +-----------+-----------+
   |           |           |
Console       CLI         SDK
(Browser)   (Terminal)  (App Code)
   |           |           |
   +-----------+-----------+
               |
        AWS API Endpoints
               |
   EC2   S3   RDS   Lambda   ...

Why Use the CLI

  • Commands run faster than a sequence of mouse clicks.
  • Scripts repeat the same task a hundred times without mistakes.
  • Automation tools run CLI commands on a schedule.
  • Commands document exactly what you did, which helps teammates.

Install and Configure the CLI

AWS provides installers for Windows, macOS, and Linux. After installation, open a terminal and confirm the version.

aws --version

Run the configure command to store your credentials.

aws configure

The tool asks four questions:

  • AWS Access Key ID
  • AWS Secret Access Key
  • Default region name, such as us-east-1
  • Default output format, such as json

Protect Your Access Keys

Access keys work like a house key and a password combined. Create them for an IAM user that holds limited permissions. Never create access keys for the root account. Never paste keys into public code repositories, chat groups, or screenshots.

Where the CLI Stores Settings

The CLI saves your details in two plain files inside a hidden folder named .aws in your home directory. The credentials file holds the keys. The config file holds the region and output format.

Command Structure

Every CLI command follows the same pattern: the word aws, a service name, an action, and optional settings.

aws s3 ls
aws ec2 describe-instances
aws iam list-users
aws sts get-caller-identity

The last command shows which identity your terminal currently uses. Run it whenever you feel unsure about which account you are working in.

Useful Options

  • --region selects a region for a single command.
  • --profile selects a named set of credentials.
  • --output changes the display to json, table, or text.
  • --query filters the result so you see only the fields you need.

Work With Profiles

A profile stores one set of credentials under a name. Teams use profiles to switch between a learning account and a project account.

aws configure --profile dev
aws s3 ls --profile dev

Practical CLI Tasks

aws s3 mb s3://my-demo-bucket-12345
aws s3 cp notes.txt s3://my-demo-bucket-12345/
aws s3 ls s3://my-demo-bucket-12345/

The first command creates a bucket. The second uploads a file. The third lists the contents. Bucket names must be unique across all of AWS, so add random digits to yours.

The AWS SDK

The SDK gives each programming language a library for AWS. Python developers use a library called Boto3. The example below prints the name of every S3 bucket in an account.

import boto3

s3 = boto3.client("s3")
response = s3.list_buckets()

for bucket in response["Buckets"]:
    print(bucket["Name"])

Real-World Flow

A photo-sharing app shows how the SDK fits into a project.

User picks a photo
        |
        v
Web App (Python + Boto3)
        |
        v
S3 Bucket "photos-demo"
        |
        v
Photo stored safely

How Credentials Are Found

Both tools search several places in a fixed order and use the first match:

  1. Settings passed directly in the command or code
  2. Environment variables
  3. Profile files in the .aws folder
  4. An IAM role attached to the EC2 instance or Lambda function

Roles are the safest choice for applications running inside AWS because no keys sit in any file.

Best Practices

  • Grant only the permissions a task needs.
  • Rotate access keys on a regular schedule.
  • Prefer temporary credentials and IAM roles over long-term keys.
  • Test commands in a practice account before touching production.

Common Mistakes

  • Running commands in the wrong region and wondering where resources vanished.
  • Leaving unused resources running after a practice session.
  • Committing access keys to a code repository.

Delete practice buckets and instances once you finish experimenting. Clean habits keep your account tidy and your bill small.

Previous lesson
Back to course
Next lesson