Back to All Cheatsheet Libraries cheatsheets

AWS

AWS CLI command reference, the core services worth knowing (EC2, S3, Lambda, IAM), and an account security baseline.

Total Commands: 0

Service	Command	Description
Config	`aws configure`	Sets access key, secret key, default region, and output format for the CLI.
S3	`aws s3 ls s3://bucket/`	Lists objects in a bucket or prefix.
S3	`aws s3 sync ./dist s3://bucket/`	Uploads only changed/new files from a local folder — the standard static-site deploy pattern.
EC2	`aws ec2 describe-instances`	Lists EC2 instances with their state, type, and IPs.
EC2	`aws ec2 start-instances --instance-ids i-xxxx`	Starts a stopped EC2 instance by ID.
IAM	`aws iam list-users`	Lists IAM users on the account.
IAM	`aws sts get-caller-identity`	Shows which account/user/role the current credentials resolve to — the fastest "am I authenticated as who I think" check.
Lambda	`aws lambda invoke --function-name NAME out.json`	Manually invokes a Lambda function and writes its response to a file.
RDS	`aws rds describe-db-instances`	Lists managed database instances and their endpoints.
CloudFormation	`aws cloudformation deploy --template-file t.yml --stack-name NAME`	Creates/updates a stack from an Infrastructure-as-Code template.
Logs	`aws logs tail /aws/lambda/NAME --follow`	Streams a CloudWatch log group in real time — the fastest way to watch a Lambda's live output.
Route 53	`aws route53 list-hosted-zones`	Lists DNS hosted zones on the account.

Frequently Used Services

EC2

Virtual machines, billed by instance type/hour (or per-second) — the general-purpose compute building block most other services sit alongside.

S3

Object storage with effectively unlimited capacity — buckets hold objects addressed by key, commonly fronted by CloudFront for a CDN.

Lambda

Run code on-demand without managing a server — billed per invocation and execution time, scales to zero when idle.

RDS

Managed relational databases (Postgres, MySQL, etc.) — AWS handles patching, backups, and failover for a chosen engine.

IAM

Identity and Access Management — users, roles, and policies that control exactly what each caller is allowed to do, down to individual API actions.

VPC

An isolated virtual network per region — subnets, route tables, and security groups define what can reach what.

IAM Concepts

User

Long-lived credentials

Role

Assumed temporarilyNo long-lived keys

Policy

JSON permission document

Group

Attach policies to many users

Never use the root account day-to-day

Enable MFA on root, then create an IAM user (or better, use IAM Identity Center) with only the permissions actually needed — root should only handle account-level settings.

Set a billing alert immediately

CloudWatch Billing Alarms notify at a chosen spend threshold — catches a runaway resource (an oversized instance, an infinite Lambda loop) before the invoice arrives.

Prefer roles over long-lived access keys

An EC2 instance profile or Lambda execution role hands out temporary, auto-rotating credentials — no static access key sitting in code or a config file to leak.

Manage infrastructure as code from day one

CloudFormation or Terraform, even for a small stack — console-clicked resources are hard to reproduce, audit, or tear down cleanly later.

Quick Tips

Tag everything from creation

Cost Explorer and cleanup scripts both depend on consistent tags (Project, Environment, Owner) — retrofitting tags onto an untagged account is far more work.

Pick a region deliberately, then stay consistent

Cross-region data transfer and latency add up — most small projects are better off in one primary region than spread across several for no strong reason.

--dry-run before a destructive call

Many EC2 CLI commands support --dry-run to validate permissions/parameters without actually executing — cheap insurance before a terminate-instances call.