AWS

Practical AWS CLI reference for IAM, EC2, ECS, S3, RDS, and Lambda — covering setup, common commands, and cost optimization for cloud development.

What this covers

Practical AWS CLI commands and configuration for IAM, EC2, ECS, S3, RDS, and Lambda, plus AWS CLI setup, CodeBuild, logging/monitoring, and cost optimization — the day-to-day operations needed for cloud development on AWS.

When to use it

Setting up IAM users, groups, roles, instance profiles, and policies
Configuring the AWS CLI (profiles, credentials, environment variables) for a new environment
Launching, starting/stopping, or securing EC2 instances and security groups
Setting up EC2 Auto Scaling for a workload
Deploying containerized workloads to ECS/Fargate, including task definitions and load balancer listeners
Managing S3 buckets, storage classes, and bucket policies
Provisioning an RDS database instance
Creating or configuring an AWS Lambda function
Setting up a CodeBuild project for CI/CD
Reviewing logging/monitoring options or planning AWS cost optimization
Onboarding onto AWS for the first time

Identity and Access Management (IAM)

IAM is AWS’s service for controlling access to AWS resources. It allows you to manage users, groups, roles, and permissions.

IAM Concepts

Users: Individual identities with credentials.
Groups: Collections of users with shared permissions.
Roles: Assignable permissions for services or users.
Policies: JSON documents defining allowed/denied actions.

Common IAM Commands

List Roles:

aws iam list-roles --profile bf-gsgteaser-sandbox

Create Instance Profile:

aws iam create-instance-profile --instance-profile-name test_ec2_ssm_profile --profile bf-gsgteaser-sandbox

Add Role to Instance Profile:

aws iam add-role-to-instance-profile --instance-profile-name test_ec2_ssm_profile --role-name test_ec2_ssm --profile bf-gsgteaser-sandbox

List Instance Profiles:

aws iam list-instance-profiles --profile bf-gsgteaser-sandbox

Create User and Group:

aws iam create-user --user-name john-doe
aws iam create-group --group-name developers
aws iam add-user-to-group --user-name john-doe --group-name developers

Attach Managed Policy:

aws iam attach-user-policy \
  --user-name john-doe \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

Create and Attach Custom Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

aws iam create-policy \
  --policy-name MyCustomPolicy \
  --policy-document file://policy.json

aws iam attach-user-policy \
  --user-name john-doe \
  --policy-arn arn:aws:iam::123456789012:policy/MyCustomPolicy

Create Role for EC2:

aws iam create-role \
  --role-name EC2-ReadOnly \
  --assume-role-policy-document file://trust-policy.json

Trust Policy for EC2 Role (trust-policy.json):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Attach Role to EC2 Instance (via instance profile):

aws ec2 associate-iam-instance-profile \
  --instance-id i-1234567890abcdef0 \
  --iam-instance-profile Name=EC2-ReadOnly-Profile

IAM Best Practices

Principle of Least Privilege: Grant only necessary permissions.
Use Groups and Roles: Assign permissions to groups/roles instead of individual users.
Enable MFA: Require multi-factor authentication for privileged users.
Rotate Credentials: Change access keys and passwords regularly.
Monitor Activity: Use CloudTrail and IAM Access Analyzer.
Regular Audits: Review and remove unused users, roles, and policies.
Policy Conditions: Use policy conditions for additional security.
Service Control Policies: Apply SCPs in AWS Organizations for account-level control.

AWS CLI Configuration

Profiles

aws configure --profile myprofile
aws s3 ls --profile myprofile

Environment Variables

export AWS_ACCESS_KEY_ID=your_access_key
export AWS_SECRET_ACCESS_KEY=your_secret_key
export AWS_DEFAULT_REGION=us-east-1

Developer Tools

AWS CodeBuild

List Projects and Builds:

aws codebuild list-projects --profile testuser-sandbox
aws codebuild list-builds --profile testuser-sandbox

Features:

Managed build environment (no servers to maintain)
Multi-language support
CI/CD integration with CodePipeline
Custom Docker images
Parallel builds

Logging and Monitoring

CloudWatch: Metrics, logs, alarms
CloudTrail: Auditing and governance
X-Ray: Distributed application tracing
AWS Config: Compliance monitoring
Trusted Advisor: Security, cost, performance checks

Cost Optimization

Right-size resources
Use Reserved or Savings Plans for predictable workloads
Implement Auto Scaling
Monitor usage with Cost Explorer
Clean up unused resources

Amazon EC2

Instance Types

General Purpose: T3, M5, M6g
Compute Optimized: C5, C6g
Memory Optimized: R5, R6g, X1, X1e
Storage Optimized: I3, D2, D3
Accelerated Computing: P3, P4, G4dn, G5

EC2 Commands

aws ec2 run-instances --image-id ami-0abcdef1234567890 \
  --count 1 --instance-type t2.micro \
  --key-name my-key-pair \
  --security-group-ids sg-12345678 \
  --subnet-id subnet-12345678

Start/Stop/Terminate:

aws ec2 start-instances --instance-ids i-1234567890abcdef0
aws ec2 stop-instances --instance-ids i-1234567890abcdef0
aws ec2 terminate-instances --instance-ids i-1234567890abcdef0

Security Group Example:

aws ec2 create-security-group --group-name my-sg --description "My security group"
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 --protocol tcp --port 22 --cidr 0.0.0.0/0

0.0.0.0/0 opens port 22 to the entire internet — scope --cidr to a known IP range in production.

EC2 Auto Scaling

Launch Configurations are deprecated — new instance types and features are only available through Launch Templates.

aws ec2 create-launch-template \
  --launch-template-name my-lt \
  --launch-template-data '{"ImageId":"ami-0abcdef1234567890","InstanceType":"t2.micro"}'

aws autoscaling create-auto-scaling-group \
  --auto-scaling-group-name my-asg \
  --launch-template LaunchTemplateName=my-lt,Version='$Latest' \
  --min-size 1 --max-size 10 --desired-capacity 2 \
  --availability-zones us-east-1a

Amazon ECS

Task Definition Example (Fargate):

{
  "family": "my-app",
  "taskRoleArn": "arn:aws:iam::123456789012:role/ecsTaskRole",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "256",
  "memory": "512",
  "containerDefinitions": [
    {
      "name": "my-container",
      "image": "nginx:latest",
      "essential": true,
      "portMappings": [{"containerPort": 80,"protocol": "tcp"}]
    }
  ]
}

Register Task Definition:

aws ecs register-task-definition --cli-input-json file://task-definition.json

Create Listener (correct JSON format):

aws elbv2 create-listener \
  --load-balancer-arn arn:aws:elasticloadbalancing:... \
  --protocol HTTP --port 80 \
  --default-actions '[{"Type":"forward","TargetGroupArn":"arn:aws:elasticloadbalancing:..."}]'

Amazon S3

Buckets: Containers for objects
Objects: Files with metadata
Keys: Unique object identifiers
Regions: Geographical storage locations

Change Storage Class Safely:

aws s3 cp s3://my-bucket/myfile.txt s3://my-bucket/myfile.txt \
  --storage-class STANDARD_IA --metadata-directive COPY

Bucket Policy Example:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}

Amazon RDS

Create DB Instance:

aws rds create-db-instance \
  --db-instance-identifier mydb \
  --db-instance-class db.t2.micro \
  --engine mysql \
  --master-username admin \
  --master-user-password mypassword \
  --allocated-storage 20 \
  --backup-retention-period 7 \
  --storage-encrypted

Backups and Snapshots:

aws rds create-db-snapshot --db-instance-identifier mydb --db-snapshot-identifier mydb-snapshot-1
aws rds describe-db-snapshots --db-instance-identifier mydb

Automated backups (--backup-retention-period) and encryption at rest (--storage-encrypted) should be set at creation time; restrict access with security groups rather than public accessibility.

AWS Lambda

Create Function:

aws lambda create-function \
  --function-name my-function \
  --runtime python3.9 \
  --role arn:aws:iam::123456789012:role/lambda-role \
  --handler lambda_function.lambda_handler \
  --code S3Bucket=my-bucket,S3Key=function.zip

Add an S3 Trigger:

aws lambda add-permission \
  --function-name my-function \
  --principal s3.amazonaws.com \
  --statement-id s3invoke \
  --action lambda:InvokeFunction \
  --source-arn arn:aws:s3:::my-bucket

Other common triggers: API Gateway (HTTP requests), DynamoDB Streams (table changes), EventBridge (scheduled or event-driven).

Environment Variables, Memory, Timeout, and Layers:

aws lambda update-function-configuration \
  --function-name my-function \
  --environment "Variables={STAGE=prod}" \
  --memory-size 256 \
  --timeout 15 \
  --layers arn:aws:lambda:us-east-1:123456789012:layer:my-layer:1

Getting Started

Create AWS account, configure billing alerts.
Set up AWS CLI and profiles.
Learn IAM basics and create users/roles.
Explore AWS services via console.
Start with free-tier services.
Implement monitoring, logging, and security from the start.

← Back to Homepage