AWS CLI Cheat Sheet

The installation and configuration process for AWS CLI is fairly simple. The package itself is installed with pip:

yum -y install python-pip
pip install awscli --upgrade --user

Selecting what you need from the output can be accomplished via awscli filters and queries; using the excellent jq JSON processor; or just using awk, sed, and whatever other standard shell tools you like. My preference is to keep awscli queries simple and do most of the formatting in the shell.

The first time you run awscli you will be prompted to provide your API credentials. You would need to supply the AWS Access Key ID, the AWS Secret Access Key, and the default region the can be modified from command line along with other variables.

You can obtain this info by logging into your AWS account, clicking on your username in the upper right-hand corner ➡ My Security Credentials ➡ Users ➡ Select your username ➡ Security Credentials ➡ Create access key.

In the examples below I used a variety of methods for massaging the output. Not because this was the most efficient way of doing things, but just to illustrate the available options.

List running instances

aws ec2 describe-instances \
--filters Name=instance-state-name,Values=running \
--query 'Reservations[].Instances[].[InstanceId]'

List all instances in a table format

aws ec2 describe-instances \
--query 'Reservations[].Instances[].[Placement.AvailabilityZone, State.Name, InstanceId,InstanceType,Platform,Tags.Value,State.Code,Tags.Values]' \
--output table

See if any running instances have scheduled events

for i in $(aws ec2 describe-instances \
--filters Name=instance-state-name,Values=running \
--query 'Reservations[].Instances[].[InstanceId]'); do 
if [ $(aws ec2 describe-instance-status --instance-id ${i} 2>/dev/null | grep -c ^EVENTS) -eq 1 ]; then 
aws ec2 describe-instance-status \
--instance-id ${i} \
--output=json | \
jq -r '.InstanceStatuses[].Events[] | join(",")' | \
awk -v var="${i}," '{print var$0}' | \
(echo "Instance,Description,Code,Start,End" && cat) | \
column -s',' -t; fi; done

List stopped instances and reason why

aws ec2 describe-instances \
--filters Name=instance-state-name,Values=stopped \
--output json | \
jq -r .Reservations[].Instances[].StateReason.Message

List AWS Dashboard users

aws iam list-users --output table

List EBS volumes for a specific instance

i=<InstanceId>; aws ec2 describe-instances \
--filter Name="instance-id",Values="${i}" \
--output json | \
jq -r '.Reservations[].Instances[] | "\(.InstanceId) \(.Tags[].Value) \(.BlockDeviceMappings[].DeviceName) \(.BlockDeviceMappings[].Ebs.VolumeId)"'

List EBS volumes for all instances

for i in $(aws ec2 describe-instances \
--filters Name=instance-state-name,Values=running \
--query 'Reservations[].Instances[].[InstanceId]'); do 
aws ec2 describe-instances \
--filter Name="instance-id",Values="${i}" \
--output json | \
jq -r '.Reservations[].Instances[] | "\(.InstanceId) \(.Tags[].Value) \(.BlockDeviceMappings[].DeviceName) \(.BlockDeviceMappings[].Ebs.VolumeId)"'
done

List snapshots of volumes for a specific instance

NOTE: It would appear that particularly old snapshots are not reported via the CLI, while still visible in the Web UI. I am not sure if this is by design, or if this is just some issue on my end. I briefly consulted the documentation, but did not find any mention of this behavior.

i=<InstanceId>; for j in $(aws ec2 describe-instances \
--filter Name="instance-id",Values="${i}" \
--output text | grep ^EBS | awk '{print $NF}'); do 
aws ec2 describe-snapshots \
--filter "Name=volume-id,Values=${j}" \
--query 'Snapshots[*].SnapshotId' \
--output text
done

Describe snapshots of volumes for a specific instance

i="<InstanceId>"; for j in $(aws ec2 describe-instances \
--filter Name="instance-id",Values="${i}" \
--output text | grep ^EBS | awk '{print $NF}'); do 
aws ec2 describe-snapshots \
--filter "Name=volume-id,Values=${j}" \
--output text
done

Generate snapshot report for all running instances

for i in $(aws ec2 describe-instances \
--filters Name=instance-state-name,Values=running \
--query 'Reservations[].Instances[].[InstanceId]'); do 
aws ec2 describe-instances \
--filter Name="instance-id",Values="${i}" \
--output json | \
jq -r '.Reservations[].Instances[] | "\(.InstanceId) \(.Tags[].Value) \(.BlockDeviceMappings[].DeviceName) \(.BlockDeviceMappings[].Ebs.VolumeId)"'
for j in $(aws ec2 describe-instances \
--filter Name="instance-id",Values="${i}" \
--output text | grep ^EBS | awk '{print $NF}'); do 
aws ec2 describe-snapshots \
--filter "Name=volume-id,Values=${j}" \
--output text; done
echo "------------"; done

Make a screenshot of the instance's terminal and email it

i=<instance_id>; e=<your_email>; d=$(date +'%Y-%m-%d_%H%M%S')
s="Screenshot of ${i} at ${d}"; f="${i}_screenshot_${d}.jpg"
aws ec2 get-console-screenshot \
--wake-up \
--instance-id ${i} | \
base64 --decode 2>/dev/null > ${f}
echo "${s}" | mailx -s "${s}" -a "${f}" ${e}