How to Install and Configure AWS CLI v2 on macOS, Linux, and Windows

What the AWS CLI is and why you need it

The AWS Command Line Interface (CLI) is a single tool that lets you create, read, update, and delete AWS resources from your terminal. Instead of clicking through the AWS Console in a browser, you type short commands that do the same thing. You can then script, repeat, and version-control those commands.

The CLI matters because most real-world AWS work goes beyond the Console. Automation scripts, CI/CD pipelines, infrastructure provisioning, and day-to-day admin tasks are all faster and more reliable when driven from the command line. If you plan to work with AWS professionally, the CLI is one of the first tools to learn.

When to use the AWS CLI

• Local development: test S3 uploads, invoke Lambda functions, or query DynamoDB tables without leaving your editor.
• Automation and scripts: write Bash or PowerShell scripts that provision resources, rotate secrets, or generate reports on a schedule.
• CI/CD pipelines: deploy code, push container images, or invalidate CloudFront caches as part of an automated build.
• Multi-account work: switch between development, staging, and production accounts using named profiles instead of logging in and out of the Console.
• Teams using SSO / IAM Identity Center: authenticate once via browser, then run commands across every account your role can access.

AWS CLI vs Console vs CloudShell

If you just need a quick command without installing anything, AWS CloudShell is a good option. For anything repeatable, the local CLI is the better choice.

Before you start

You need an active AWS account. If you do not have one, create a free-tier account at aws.amazon.com.

There are two main ways to authenticate the CLI:

• Long-lived access keys are an Access Key ID and Secret Access Key tied to an IAM user. These never expire on their own, which makes them a security risk if leaked. They work for learning and personal projects but are not recommended for teams or production.

• Temporary credentials are short-lived tokens issued by AWS STS or IAM Identity Center (SSO). These expire automatically and are the preferred approach wherever available.

For a deeper comparison, see AWS Access Keys Explained.

Install AWS CLI v2 on macOS

AWS CLI v2 is the version to install for all new setups. It does not require a separate Python installation.

Option 1: Homebrew

brew install awscli

Option 2: Official .pkg installer

# Download the installer
curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"

# Run it (requires admin)
sudo installer -pkg AWSCLIV2.pkg -target /

Verify

aws --version
# Expected output (version numbers will vary):
# aws-cli/2.x.x Python/3.x.x Darwin/... source/...

Install AWS CLI v2 on Linux

You need curl (or wget) and unzip installed. Most distributions include both by default.

x86_64 (Intel / AMD)

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

ARM / aarch64 (Graviton, Raspberry Pi, etc.)

curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

Verify

aws --version

Install AWS CLI v2 on Windows

Download and run the official MSI installer:

1. Download AWSCLIV2.msi from the AWS CLI v2 install page.
2. Run the installer and follow the prompts.
3. Open a new PowerShell or Command Prompt window (existing windows will not see the updated PATH).

aws --version
# aws-cli/2.x.x Python/3.x.x Windows/...

winget install Amazon.AWSCLI

Verify the installation

Run these commands after installing to confirm everything works. The first two do not require credentials. The third and fourth require a configured profile.

# 1. Check the installed version
aws --version

# 2. List configured profiles (empty list is fine at this point)
aws configure list-profiles

# 3. After configuring credentials (next section), confirm your identity
aws sts get-caller-identity

# 4. Show all settings for the active profile
aws configure list

If aws —version prints a version string, the binary is installed and on your PATH. If the command is not found, see the troubleshooting section below.

How AWS CLI configuration works

The CLI stores its settings in two files inside your home directory:

• ~/.aws/credentials stores the access key ID and secret access key for each profile.
• ~/.aws/config stores the region, output format, SSO settings, and other options for each profile.

On Windows these files live at C:\Users\USERNAME\.aws\.

The CLI looks for configuration in this order of precedence (highest wins):

1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION)
2. Profile settings in ~/.aws/credentials and ~/.aws/config

This means an environment variable always overrides whatever is in your config files. The [default] profile is used when you do not specify —profile.

Configure the default profile

Run aws configure and answer each prompt:

aws configure

You will see four prompts:

Use named profiles for multiple AWS accounts

Most teams have separate AWS accounts for development, staging, and production. Named profiles let you keep credentials for each account on one machine and switch between them safely.

# Create a profile called "staging"
aws configure --profile staging

# Run a command against the staging account
aws s3 ls --profile staging

# Set a profile for your entire terminal session
export AWS_PROFILE=staging       # macOS / Linux
# $env:AWS_PROFILE = "staging"   # PowerShell

# Verify which identity is active
aws sts get-caller-identity

# Switch back to the default profile
unset AWS_PROFILE                # macOS / Linux
# Remove-Variable AWS_PROFILE    # PowerShell

After configuring two profiles, your ~/.aws/config looks like this:

[default]
region = us-east-1
output = json

[profile staging]
region = us-west-2
output = json

And ~/.aws/credentials:

[default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[staging]
aws_access_key_id = AKIAI44QH8DHBEXAMPLE
aws_secret_access_key = je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY

Configure IAM Identity Center (SSO)

IAM Identity Center (formerly AWS SSO) is the recommended way to authenticate the CLI in team and enterprise environments. Instead of storing long-lived keys on disk, you log in through a browser and receive temporary credentials that expire automatically.

# Start the SSO configuration wizard
aws configure sso

You will be prompted for:

• SSO session name is a label you choose, for example my-org.
• SSO start URL is your organization’s access portal URL, for example https://my-company.awsapps.com/start.
• SSO region is the region where Identity Center is configured (ask your admin if unsure).
• SSO registration scopes is usually sso:account:access.

A browser window opens for you to approve the device authorization. After approval, the CLI lists the accounts and roles available to you. Select one, and the wizard saves a named profile to ~/.aws/config.

# Log in when your session expires
aws sso login --profile my-org-dev

# Run commands with the SSO profile
aws s3 ls --profile my-org-dev

# Log out (invalidates the cached token)
aws sso logout

Use environment variables safely

Environment variables are the highest-priority credential source. They are useful in two scenarios:

• CI/CD pipelines: inject credentials from a secrets manager at runtime so nothing is stored on disk.
• Temporary overrides: point a single terminal session at a different account without changing your config files.

export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_DEFAULT_REGION=us-east-1

First commands to run after installation

Once the CLI is installed and configured, try these commands to confirm everything is working and start exploring.

# Who am I? Returns your account ID, user ARN, and user ID.
aws sts get-caller-identity

# List S3 buckets in the account (empty list is normal for new accounts)
aws s3 ls

# Show the active profile's settings: region, access key (masked), and source
aws configure list

If aws sts get-caller-identity returns your account details, your credentials are valid and the CLI is ready. From here you can start running real commands. See Using the AWS CLI for command structure and output formatting, or try uploading files to S3 with the AWS CLI as a hands-on next step.

Troubleshooting AWS CLI install and auth issues

”command not found” after installation

Open a new terminal window. If the issue persists, check where the binary was installed:

# macOS / Linux
which aws
# Expected: /usr/local/bin/aws

# Windows (PowerShell)
where.exe aws

If nothing is returned, the installer did not add the binary to your PATH. On Linux, the installer creates /usr/local/bin/aws as a symlink to /usr/local/aws-cli/v2/current/bin/aws. Verify the symlink exists and that /usr/local/bin is in your $PATH.

Wrong version returned

If aws —version shows aws-cli/1.x.x, you have both v1 and v2 installed. Remove v1:

# If v1 was installed via pip
pip uninstall awscli

# Then confirm v2 is active
aws --version

“Access Denied” or “InvalidClientTokenId”

Your credentials are missing, expired, or do not have the required permissions. Run aws configure list to check which credentials are active, and verify the IAM user or role has the permissions you need. For a full walkthrough, see Troubleshooting Authentication Errors in AWS.

”ExpiredToken” or “The SSO session has expired"

aws sso login --profile PROFILE_NAME

"Region not configured"

# Set a default region
aws configure set region us-east-1

# Or pass it per-command
aws s3 ls --region us-east-1

"Profile not found”

Check the exact spelling of your profile name:

aws configure list-profiles

Profile names are case-sensitive. Make sure —profile matches what is in ~/.aws/config.