AWS CLI Explained for Beginners: Commands, Profiles, Output, and Examples

What the AWS CLI is in simple terms

If you have used the AWS Management Console, you already understand what AWS services do. You click buttons, fill in forms, and things happen in your account. The AWS CLI does the same things, but through typed commands in a terminal.

For example, instead of opening the S3 console, navigating to your bucket, and clicking “Upload,” you type:

aws s3 cp report.csv s3://my-bucket/

That single command uploads the file. Behind the scenes, both the console and the CLI talk to the same AWS APIs. The CLI is just a different way to send those API requests.

You can install the AWS CLI on macOS, Linux, or Windows. Once installed and configured with credentials, every AWS service is accessible from your terminal.

Why people use the AWS CLI

The console works well for exploring services and learning how things fit together. But for day-to-day work, the CLI has clear advantages:

• Repeatability. A CLI command can be run identically every time. A sequence of console clicks cannot be reliably repeated.
• Scripting. You can put CLI commands in a shell script and run ten operations with one command.
• Automation. CLI commands work in CI/CD pipelines, cron jobs, and deployment scripts where a browser is not available.
• Version control. A script with CLI commands can be committed to Git, reviewed in a pull request, and tracked over time.
• Speed for bulk tasks. Tagging 50 instances, listing resources across regions, or cleaning up old snapshots is much faster from the terminal.

None of this means you should stop using the console. The best approach is to use both: the console for exploration and visual confirmation, the CLI for repeatable work and automation.

AWS CLI vs Console vs CloudShell

AWS gives you three main ways to interact with services. Each is best in different situations:

AWS CloudShell is a good middle ground when you need to run a quick command but do not have the CLI installed locally. For anything beyond one-off tasks, a local CLI installation gives you full control.

How the AWS CLI works

Every CLI command translates into an API call to an AWS service. The mental model is straightforward:

1. You type a command that names a service and an operation.
2. The CLI signs the request using your access key credentials and sends it to the correct AWS API endpoint.
3. AWS processes the request and returns structured data (usually JSON).
4. The CLI displays the response in your chosen output format.

Basic AWS CLI command structure

Every AWS CLI command follows the same pattern:

aws <service> <operation> [options]

The service is the AWS product (like s3, ec2, or iam). The operation is the action (like ls, describe-instances, or list-users). Options are extra parameters like filters, output format, or the target resource.

# List your S3 buckets
aws s3 ls

# Describe all EC2 instances in the current region
aws ec2 describe-instances

# List all IAM users in your account
aws iam list-users

# Check who you are authenticated as
aws sts get-caller-identity

You can get help for any level of the hierarchy. Run aws help to list all services. Run aws s3 help to see S3 operations. Run aws s3 cp help to see options for a specific command.

Output formats and the —query flag

CLI commands return structured data. You control the format with the —output flag:

• json (default): full JSON, good for piping to tools like jq
• text: tab-separated values, useful inside shell scripts
• table: human-readable ASCII table, useful for quick visual checks
• yaml: YAML output, handy when comparing with CloudFormation templates

# Default JSON output
aws sts get-caller-identity

# Same command, but only the Account ID as plain text
aws sts get-caller-identity --query Account --output text

# EC2 instances displayed as a table
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].{ID:InstanceId,State:State.Name,Type:InstanceType}' \
  --output table

Filtering output with JMESPath

AWS commands often return large JSON payloads. The —query flag filters the response using a language called JMESPath, so you only see what matters.

Think of JMESPath as a path into the JSON structure. If the response has a top-level key called Buckets containing an array, —query ‘Buckets[*].Name’ pulls out just the bucket names.

# List only bucket names
aws s3api list-buckets --query 'Buckets[*].Name'

# Get instance IDs of running instances
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].InstanceId' \
  --output text

# Get the ARN of a specific IAM role
aws iam get-role \
  --role-name MyAppRole \
  --query 'Role.Arn' \
  --output text

Profiles, credentials, and authentication

Before the CLI can make API calls, it needs credentials that prove who you are. When you run aws configure, the CLI stores your access key and secret key in files under ~/.aws/.

Named profiles

If you work with more than one AWS account (dev, staging, production), named profiles let you switch between them without editing your credentials each time:

# Create a named profile
aws configure --profile mycompany-dev

# Use a specific profile for one command
aws s3 ls --profile mycompany-dev

# Set a profile for the entire terminal session
export AWS_PROFILE=mycompany-dev

Each profile can have its own region, output format, and credential type. Profile credentials live in ~/.aws/credentials and configuration in ~/.aws/config.

Verifying your identity before sensitive actions

Before running any command that changes resources, confirm which account and identity you are using:

aws sts get-caller-identity

This returns your account ID, user or role ARN, and the identity you are authenticated as. It costs nothing and takes a second. Making this a habit prevents the most common CLI mistake: running a destructive command against the wrong account.

When to use the AWS CLI

The CLI is not always the right tool. Here are the scenarios where it shines:

• Checking your identity or account quickly. aws sts get-caller-identity confirms who you are in one command, faster than navigating the console.

• Listing or inspecting resources. Commands like aws ec2 describe-instances or aws s3 ls give you a fast summary without loading a web page.

• Uploading files to S3. aws s3 cp and aws s3 sync handle single files or entire directories. See the S3 overview for more on how S3 works.

• Scripting and CI/CD. CLI commands in shell scripts or pipeline steps can deploy code, run database migrations, or clean up old resources automatically.

• Switching between accounts. With named profiles, you can target any account without signing out and back in to the console.

• Managing IAM from the command line. Creating users, attaching policies, and listing roles are faster from the CLI when you already know what you need.

For visual exploration, dashboards, and tasks you have never done before, the Management Console is usually the better starting point.

Real examples beginners actually need

These are the commands you will reach for most often when getting started:

# Confirm your identity and account
aws sts get-caller-identity

# List your S3 buckets
aws s3 ls

# List objects inside a specific bucket
aws s3 ls s3://my-bucket/

# Upload a file to S3
aws s3 cp report.csv s3://my-bucket/reports/

# Sync a local directory to S3
aws s3 sync ./build s3://my-bucket/static/

# List EC2 instances with useful columns
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[*].{ID:InstanceId,State:State.Name,Type:InstanceType}' \
  --output table

# List IAM users
aws iam list-users --output table

# Get your account ID as a plain string (useful in scripts)
aws sts get-caller-identity --query Account --output text

# Use a named profile for a single command
aws s3 ls --profile production

# Check permissions before stopping an instance (dry run)
aws ec2 stop-instances --instance-ids i-0abc123 --dry-run

Each of these commands follows the same aws <service> <operation> pattern. Once you are comfortable with these, you can extend to any AWS service. The structure stays the same.