[[..|Directorio superior]]
====== AWS Command line interface ======

===== Installation and setup =====

There are a number of different ways to install the AWS CLI on your
machine, depending on what operating system and environment you are
using:

On Microsoft Windows – use the MSI installer. On Linux, OS X, or Unix –
use pip (a package manager for Python software) or install manually with
the bundled installer.

==== Install using pip: ====

You will need python to be installed (version 2, 2.6.5+,3 or 3.3+).
Check with

<code bash>
python --version
pip --help
</code>

Given that both of these are installed, use the following command to
install the aws cli.

<code bash>
sudo pip install awscli
</code>

Install on Windows The AWS CLI is supported on Microsoft Windows XP or
later. For Windows users, the MSI installation package offers a familiar
and convenient way to install the AWS CLI without installing any other
prerequisites. Windows users should use the MSI installer unless they
are already using pip for package management.

MSI Installer for Windows 32-bit MSI Installer for Windows 64-bit Run
the downloaded MSI installer. Follow the instructions that appear.

==== To install the AWS CLI using the bundled installer ====

Prerequisites:

  * Linux, OS X, or Unix
  * Python 2 version 2.6.5+ or Python 3 version 3.3+
  * Download the AWS CLI Bundled Installer using wget or curl.

Unzip the package.

Run the install executable.

On Linux and OS X, here are the three commands that correspond to each
step:

<code sh>
curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip"
unzip awscli-bundle.zip
sudo ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws
</code>

Install using HomeBrew on OS X:

Another option for OS X

<code sh>
brew install awscli
</code>

==== Test the AWS CLI Installation ====

Confirm that the CLI is installed correctly by viewing the help file.
Open a terminal, shell or command prompt, enter aws help and press
Enter:

    aws help

==== Configuring the AWS CLI ====

Once you have finished the installation you need to configure it. You’ll
need your access key and secret key that you get when you create your
account on aws. You can also specify a default region name and a default
output type (text|table|json).

    $ aws configure
    AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
    AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
    Default region name [None]: us-west-2
    Default output format [None]: ENTER

==== Updating the CLI tool ====

Amazon periodically releases new versions of the AWS Tool. If the tool
was installed using the Python Pip tool the following command will check
the remote repository for updates, and apply it to your local system.

    pip install awscli --upgrade

===== Using aws cli commands =====

The syntax for using the aws cli is as follows:

    aws [options] <command> <subcommand> [parameters]

Some examples using the ‘ec2’ command and the ‘describe-instances’
subcommand:

    aws ec2 describe-instances
    aws ec2 describe-instances --instance-ids <your-id>

Example with a fake id:

    aws ec2 describe-instances --instance-ids i-c71r246a

==== IAM ====

=== Users ===

  * [[https://blogs.aws.amazon.com/security/post/Tx15CIT22V4J8RP/How-to-rotate-access-keys-for-IAM-users|How to rotate access keys]]
  * [[http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html|Reference IAM Limits]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/iam/index.html|IAM]]
  * Limits = 5000 users, 100 group, 250 roles, 2 access keys / user

<code bash>
aws iam list-users
aws iam list-users --output text | cut -f 6 # list all users usernames
aws iam list-users --no-paginate
aws iam get-user # list current users info
aws iam get-user --user-name aws-admin2
aws iam list-access-keys # list current users access keys
aws iam create-user --user-name aws-admin2 # create new user
aws iam delete-user --user-name aws-admin2
</code>

create multiple new users, from a file

<code bash>
allUsers=$(cat ./user-names.txt)
for userName in $allUsers; do
    aws iam create-user \
        --user-name $userName
done
</code>

===== delete all users =====

<code bash>
# allUsers=$(aws iam list-users --output text | cut -f 6);
allUsers=$(cat ./user-names.txt)
for userName in $allUsers; do
    aws iam delete-user \
        --user-name $userName
done
</code>

=== Password policy ===

  * [[http://docs.aws.amazon.com/cli/latest/reference/iam/|IAM]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/iam/get-account-password-policy.html|Get account password policy]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/iam/update-account-password-policy.html|Update account password policy]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/iam/delete-account-password-policy.html|Delete account password policy]]

    aws iam get-account-password-policy # list policy
    aws iam delete-account-password-policy # delete policy

=== set policy ===

    aws iam update-account-password-policy \
        --minimum-password-length 12 \
        --require-symbols \
        --require-numbers \
        --require-uppercase-characters \
        --require-lowercase-characters \
        --allow-users-to-change-password

=== Access Keys ===

  * [[http://docs.aws.amazon.com/cli/latest/reference/iam/|IAM]]

    aws iam list-access-keys                        # list all access keys
    aws iam list-access-keys --user-name aws-admin2 # list access keys of a specific user

create a new access key

    aws iam create-access-key --user-name aws-admin2 --output text | tee aws-admin2.txt

list last access time of an access key

    aws iam get-access-key-last-used --access-key-id AKIAINA6AJZY4EXAMPLE

deactivate an acccss key

    aws iam update-access-key \
        --access-key-id AKIAI44QH8DHBEXAMPLE \
        --status Inactive \
        --user-name aws-admin2

delete an access key

    aws iam delete-access-key \
        --access-key-id AKIAI44QH8DHBEXAMPLE \
        --user-name aws-admin2

=== Groups, Policies, Managed Policies ===

  * [[http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html|Id roles]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/iam/|IAM]]

<code bash>
aws iam list-groups                                          # list all groups
aws iam create-group --group-name FullAdmins                 # create a group
aws iam delete-group --group-name FullAdmins                 # delete a group
aws iam list-policies                                        # list all policies
aws iam get-policy --policy-arn <value>                      # get a specific policy
aws iam list-entities-for-policy --policy-arn <value>        # list all users, groups, and roles, for a given policy
aws iam list-attached-group-policies --group-name FullAdmins # list policies, for a given group
aws iam get-group --group-name FullAdmins                    # list users, for a given group
aws iam list-groups-for-user --user-name aws-admin2          # list groups, for a given user
aws iam delete-group --group-name FullAdmins                 # delete a group
aws iam add-user-to-group --group-name FullAdmins --user-name aws-admin2 # add a user to a group
</code>

add a policy to a group

<code bash>
aws iam attach-group-policy \
    --group-name FullAdmins \
    --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
</code>

remove a user from a group

<code bash>
aws iam remove-user-from-group \
  *-group-name FullAdmins \
  *-user-name aws-admin2
</code>

remove a policy from a group

<code bash>
aws iam detach-group-policy \
  *-group-name FullAdmins \
  *-policy-arn arn:aws:iam::aws:policy/AdministratorAccess
</code>

==== Cloudwatch ====

=== Log Groups ===

  * [[http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/WhatIsCloudWatchLogs.html|What Is Cloud Watch Logs]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/logs/index.html|Logs]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/logs/create-log-group.html|Create log group]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html|Describe log groups]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/logs/delete-log-group.html|Delete log group]]

    aws logs create-log-group --log-group-name "DefaultGroup" # create a group
    aws logs describe-log-groups                              # list all log groups
    aws logs describe-log-groups --log-group-name-prefix "Default"
    aws logs delete-log-group --log-group-name "DefaultGroup" # delete a group

==== Log Streams ====

  * [[http://docs.aws.amazon.com/cli/latest/reference/logs/create-log-stream.html|Create log stream]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-streams.html|Describe log streams]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/logs/delete-log-stream.html|Delete log stream]]

Log group names can be between 1 and 512 characters long. Allowed
characters include a-z, A-Z, 0-9, (underscore), ‘-’ (hyphen), ‘/’
(forward slash), and ‘.’ (period).

create a log stream

    aws logs create-log-stream --log-group-name "DefaultGroup" --log-stream-name "syslog"

list details on a log stream

    aws logs describe-log-streams --log-group-name "syslog"
    aws logs describe-log-streams --log-stream-name-prefix "syslog"

delete a log stream

    aws logs delete-log-stream --log-group-name "DefaultGroup" --log-stream-name "Default Stream"

==== Volumes & snapshots ====

<code bash>
aws ec2 delete-snapshot           --snapshot-id snap-4e665454
aws ec2 describe-volumes
aws ec2 attach-volume             --instance-id i-dddddd70 --volume-id vol-1d5cc8cc --device /dev/sdh
</code>

Find all volumes not attached to any instance in all Regions

<code bash>
REGIONS=$(aws ec2 describe-regions --output text --query 'Regions[].[RegionName]')
for REGION in $REGIONS; do
    echo $REGION
    aws ec2 describe-volumes \
        --filter "Name=status,Values=available" \
        --query 'Volumes[*].{VolumeID:VolumeId,Size:Size,Type:VolumeType,AvailabilityZone:AvailabilityZone}' \
        --region $REGION
done
</code>

Get the status of all volumes currently in the optimizing stage (after
volume modification) in all Regions

<code bash>
for REGION in $REGIONS; do
    echo $REGION
    aws ec2 describe-volumes-modifications \
        --query 'VolumesModifications[].{VolumeID:VolumeId,
            TargetSize:TargetSize,
            OriginalSize:OriginalSize,
            Progress:Progress,
            OriginalIops:OriginalIops,
            TargetIops:TargetIops}' \
        --output json \
        --filter 'Name=modification-state,Values=optimizing' \
        --region $REGION
done
</code>

Find all volumes in the “error” state in all Regions

    for REGION in $REGIONS; do
        echo $REGION
        aws ec2 describe-volumes \
            --filter "Name=status,Values=error" \
            --query 'Volumes[*].{VolumeID:VolumeId,Size:Size,Type:VolumeType,
                    AvailabilityZone:AvailabilityZone}' \
            --region $REGION;
    done

Find all publicly available snapshots in an AWS account in all Regions

<code bash>
for REGION in $REGIONS; do
    echo "$REGION:"
    SNAPS=$(aws ec2 describe-snapshots --owner self --output json --region $REGION \
            --query 'Snapshots[*].SnapshotId' --output text)
    for snap in $SNAPS; do
        aws ec2 describe-snapshot-attribute \
            --snapshot-id $snap \
            --region $REGION \
            --output json \
            --attribute createVolumePermission \
            --query '[SnapshotId,CreateVolumePermissions[?Group == `all`]]' \
        | jq -r '.[]'
    done
    echo
done
</code>

Find all snapshots over one month old. The following command lists all
EBS snapshots using the describe-snapshots operation, where the
timestamp is older than one month ( –date=‘-1 month’).

    aws ec2 describe-snapshots --owner self --output json \
    | jq '.Snapshots[] | select(.StartTime < "'$(date --date='-1 month' '+%Y-%m-%d')'") | [.Description, .StartTime, .SnapshotId]'

List snapshots over 1 month old in all Regions

<code bash>
for REGION in $REGIONS; do
    echo $REGION
    aws ec2 describe-snapshots \
        --owner self \
        --region $REGION \
        --output json \
    | jq '.Snapshots[] | select(.StartTime < "'$(date --date='-1 month' '+%Y-%m-%d')'") | [.Description, .StartTime, .SnapshotId]'
done
</code>

=== Instances ===

  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/index.html|EC2]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html|Describe instances]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html|Run instances]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/terminate-instances.html|Terminate instances]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instance-status.html|Describe instance status]]

<code bash>
aws ec2 describe-instance-status # list status of all instances
aws ec2 reboot-instances          --instance-ids i-dddddd70
aws ec2 start-instances           --instance-ids i-dddddd70
aws ec2 stop-instances            --instance-ids i-5c8282ed
</code>

create a new instance

<code bash>
aws ec2 run-instances \
    --image-id ami-f0e7d19a \
    --instance-type t2.micro \
    --security-group-ids sg-00000000 \
    --dry-run
aws ec2 run-instances             --dry-run \
    --image-id ami-08111162 \
    --count 1 \
    --instance-type t1.micro \
    --key-name MyKeyPair \
    --security-groups my-ami-security-group
aws ec2 run-instances \
    --image-id ami-abcd1234 --count 1 --instance-type m3.medium \
    --key-name my-key-pair --subnet-id subnet-abcd1234 --security-group-ids sg-abcd1234 \
    --user-data file://myscript.txt
</code>

myscript.txt:

<code bash>
#!/bin/bash
yum update -y
service httpd start
chkconfig httpd on
</code>

otro ejemplo

<code bash>
#!/bin/bash
yum update -y amazon-linux-extras install lamp-mariadb10.2-php7.2 \
    php7.2 yum install httpd mariadb-server
systemctl start httpd
systemctl enable httpd
usermod -a -G apache ec2-user
chown -R ec2-user:apache /var/www
chmod 2775 /var/www
find /var/www -type d -exec chmod 2775 {} \;
find /var/www -type f -exec chmod 0664 {} \;
echo "<?php phpinfo(); ?>" > /var/www/html/phpinfo.php
</code>

Verify script results on /var/log/cloud-init-output.log

stop an instance

    aws ec2 terminate-instances --instance-ids INSTANCEID
    aws ec2 terminate-instances --instance-ids --dry-run i-dddddd70

list status of a specific instance

    aws ec2 describe-instances --instance-ids i-dddddd70
    aws ec2 describe-instances \
    --output text \
    --query "Reservations[*].Instances[*].[Placement.AvailabilityZone,
            State.Name,
            InstanceType,
            InstanceId,
            Tags[?Key=='Name']|[0].Value,
            Tags[?Key=='Gias_Name']|[0].Value]" \
    --filters "Name=instance-state-name,Values=running,stopped"  "Name=vpc-id,Values=XXX"

Modify attributes

<code bash>
aws ec2 modify-instance-attribute --instance-id  i-44a44ac3 \
    --instance-type "{\"Value\": \"m1.small\"}"
aws ec2 modify-instance-attribute --instance-id  i-44a44ac3 --disable-api-termination
aws ec2 modify-instance-attribute --instance-id  i-44a44ac3 --no-disable-api-termination
</code>

=== Images ===

    aws ec2 create-image \
        --instance-id i-44a44ac3 --name "Dev AMI" \
        --description "AMI for development server"
    aws ec2 describe-images  --image-ids ami-2d574747
    aws ec2 deregister-image --image-id ami-2d574747

=== Tags ===

  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-tags.html|Describe tags]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html|Create tags]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/delete-tags.html|Delete tags]]

    aws ec2 describe-tags # list the tags of an instance

add a tag to an instance

    aws ec2 create-tags --resources "ami-1a2b3c4d" --tags Key=name,Value=debian
    aws ec2 create-tags --resources i-dddddd70 --tags Key=Department,Value=Finance

delete a tag on an instance

    aws ec2 delete-tags --resources "ami-1a2b3c4d" --tags Key=Name,Value=

=== Console ===

    aws ec2 get-console-output  --instance-id i-44a44ac3
    aws ec2 monitor-instances   --instance-ids i-44a44ac3
    aws ec2 unmonitor-instances --instance-ids i-44a44ac3

==== Security Groups ====

  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/index.html|EC2]]

<code bash>
aws ec2 describe-security-groups
aws ec2 create-security-group --vpc-id vpc-1a2b3c4d --group-name web-access --description "web access"
aws ec2 describe-security-groups --group-id sg-0000000
aws ec2 delete-security-group --group-id sg-00000000
</code>

open port 80, for everyone

    aws ec2 authorize-security-group-ingress \
    --group-id sg-0000000 \
    --protocol tcp \
    --port 80 \
    --cidr 0.0.0.0/24

get my public ip

    my_ip=$(dig +short myip.opendns.com @resolver1.opendns.com);
    echo $my_ip

open port 22, just for my ip

    aws ec2 authorize-security-group-ingress \
    --group-id sg-0000000 \
    --protocol tcp \
    --port 80 \
    --cidr $my_ip/24

remove a firewall rule from a group

    aws ec2 revoke-security-group-ingress \
    --group-id sg-0000000 \
    --protocol tcp \
    --port 80 \
    --cidr 0.0.0.0/24

==== Keypairs ====

  * [[http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html|ec2-key-pairs]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-key-pairs.html|describe-key-pairs]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/create-key-pair.html|create-key-pair]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/import-key-pair.html|import-key-pair]]
  * [[http://docs.aws.amazon.com/cli/latest/reference/ec2/delete-key-pair.html|delete-key-pair]]

    aws ec2 describe-key-pairs
    aws ec2 create-key-pair --key-name dev-servers
    aws ec2 delete-key-pair --key-name dev-servers

create a new private / public keypair, using RSA 2048-bit

    ssh-keygen -t rsa -b 2048

import an existing keypair

    aws ec2 import-key-pair \
        --key-name keyname_test \
        --public-key-material file:///home/apollo/id_rsa.pub

==== Profiles ====

To setup a new credential profile with the name myprofile :

    aws configure --profile myprofile
        AWS Access Key ID [None]: ACCESSKEY
        AWS Secret Access Key [None]: SECRETKEY
        Default region name [None]: REGIONNAME
        Default output format [None]: text | table | json

For the AWS access key id and secret, create an IAM user in the AWS
console and generate keys for it. Region will be the default region for
commands in the format eu-west-1 or us-east-1 . The default output
format can either be text , table or json . You can now use the profile
name in other commands by using the –profile option, e.g.:

    aws ec2 describe-instances --profile myprofile

AWS libraries for other languages (e.g. aws-sdk for Ruby or boto3 for
Python) have options to use the profile you create with this method too.
E.g. creating a new session in boto3 can be done like this,
boto3.Session(profile\_name:‘myprofile’) and it will use the credentials
you created for the profile.

The details of your aws-cli configuration can be found in \~/.aws/config
and \~/.aws/credentials (on linux and mac-os). These details can be
edited manually from there.

==== S3 ====

    aws s3 --region eu-central-1 cp xxxxx s3://enel-staging-sc/lah/xxxxx --acl public-read
    aws s3 --region eu-central-1 cp s3://enel-staging-sc/lah/xxxxx xxxxx
    aws s3 --region eu-central-1 ls s3://enel-staging-sc/lah/xxxxx
    aws s3 --region eu-central-1 rm s3://enel-staging-sc/lah/xxxxx

Use a named profile

    aws --profile myprofile s3 ls

List all objects in a bucket, including objects in folders, with size in
human-readable format and a summary of the buckets properties in the end
  *

    aws s3 ls --recursive --summarize --human-readable s3://<bucket_name>/

==== Cloudtrail - Logging and Auditing ====

  * [[http://docs.aws.amazon.com/cli/latest/reference/cloudtrail/|Cloudtrail]]

list all trails

    aws cloudtrail describe-trails

create a new trail

    aws cloudtrail create-subscription \
        --name awslog \
        --s3-new-bucket awslog2016

list the names of all trails

    aws cloudtrail describe-trails --output text | cut -f 8

get the status of a trail

    aws cloudtrail get-trail-status --name awslog

delete a trail

    aws cloudtrail delete-trail --name awslog

delete the S3 bucket of a trail

    aws s3 rb s3://awslog2016 --force

add tags to a trail, up to 10 tags

    aws cloudtrail add-tags \
        --resource-id awslog \
        --tags-list "Key=log-type,Value=all"

list the tags of a trail

    aws cloudtrail list-tags --resource-id-list

remove a tag from a trail

    aws cloudtrail remove-tags \
        --resource-id awslog \
        --tags-list "Key=log-type,Value=all"

==== Network Load Balancer ====

Create your load balancer

    aws elbv2 create-load-balancer --name my-load-balancer --type network
    --subnets subnet-0e3f5cac72EXAMPLE

create a target group, specifying the same VPC that you used for your
EC2 instances:

    aws elbv2 create-target-group --name my-targets --protocol TCP \
    --port 80 --vpc-id vpc-0598c7d356EXAMPLE

register your instances with your target group:

    aws elbv2 register-targets --target-group-arn targetgroup-arn \
    --targets Id=i-1234567890abcdef0 Id=i-0abcdef1234567890

create a listener for your load balancer with a default rule that
forwards requests to your target group:

    aws elbv2 create-listener --load-balancer-arn loadbalancer-arn --protocol TCP --port 80  \
    --default-actions Type=forward,TargetGroupArn=targetgroup-arn

verify the health of the registered targets for your target group using
this

    aws elbv2 describe-target-health --target-group-arn targetgroup-arn

Specify an Elastic IP address for your load balancer

    aws elbv2 create-load-balancer --name my-load-balancer --type network \
    --subnet-mappings SubnetId=subnet-0e3f5cac72EXAMPLE,AllocationId=eipalloc-12345678

Delete your load balancer

    aws elbv2 delete-load-balancer --load-balancer-arn loadbalancer-arn
    aws elbv2 delete-target-group --target-group-arn targetgroup-arn

==== Others ====

    aws glacier create-vault --account-id xxxxx --vault-name myvault
    aws sts get-caller-identity

==== Get console output ====

A useful awscli feature is get-console-output which allows us to view
the Linux console of an instance shortly after the instance boots. You
will have to pipe the output of get-console-output into sed to correct
line feeds and carriage returns.

<code>
    $ aws ec2 get-console-output --instance-id i-0d9c2b31 \
    | sed 's/\\n/\n/g' | sed 

</code>

==== Completer ====

<code>
    which aws_completer
    /usr/local/bin/aws_completer

</code>

Bundled Installer – if you used the bundled installer per the
instructions in the previous section, the AWS completer will be located
in the bin subfolder of the installation directory.

<code mixed>
ls /usr/local/aws/bin
activate
activate.csh
activate.fish
activate_this.py
aws
aws.cmd
aws_completer
</code>

If all else fails, you can use find to search your entire file system
for the AWS completer.

<code mixed>
$ find / -name aws_completer
/usr/local/aws/bin/aws_completer
</code>

bash – use the built-in command complete.

<code sh>
complete -C '/usr/local/bin/aws_completer' aws
</code>

Note

/usr/local/bin is the default installation directory when you install
the AWS CLI with pip. See Locate the AWS Completer (p. 14) if you are
not sure where the AWS CLI was installed.

===== AWSCLI v2 =====

<code sh>
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
</code>