¡Esta es una revisión vieja del documento!
# Notas AWS Command line interface
## Installation and setup
There are a number of different ways to install the AWS CLI on your machine, depending on what operating system and environment you are using:
On Microsoft Windows – use the MSI installer. On Linux, OS X, or Unix – use pip (a package manager for Python software) or install manually with the bundled installer. ### Install using pip:
You will need python to be installed (version 2, 2.6.5+,3 or 3.3+). Check with
```bash python –version pip –help
```
Given that both of these are installed, use the following command to install the aws cli.
```bash sudo pip install awscli ```
Install on Windows The AWS CLI is supported on Microsoft Windows XP or later. For Windows users, the MSI installation package offers a familiar and convenient way to install the AWS CLI without installing any other prerequisites. Windows users should use the MSI installer unless they are already using pip for package management.
MSI Installer for Windows 32-bit MSI Installer for Windows 64-bit Run the downloaded MSI installer. Follow the instructions that appear. ### To install the AWS CLI using the bundled installer
Prerequisites:
- Linux, OS X, or Unix
- Python 2 version 2.6.5+ or Python 3 version 3.3+
- Download the AWS CLI Bundled Installer using wget or curl.
Unzip the package.
Run the install executable.
On Linux and OS X, here are the three commands that correspond to each step:
```sh curl “https://s3.amazonaws.com/aws-cli/awscli-bundle.zip” -o “awscli-bundle.zip” unzip awscli-bundle.zip sudo ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws ```
Install using HomeBrew on OS X:
Another option for OS X
```sh brew install awscli ```
### Test the AWS CLI Installation
Confirm that the CLI is installed correctly by viewing the help file. Open a terminal, shell or command prompt, enter aws help and press Enter:
aws help
### Configuring the AWS CLI
Once you have finished the installation you need to configure it. You’ll need your access key and secret key that you get when you create your account on aws. You can also specify a default region name and a default output type (text|table|json).
$ aws configure AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY Default region name [None]: us-west-2 Default output format [None]: ENTER
### Updating the CLI tool
Amazon periodically releases new versions of the AWS Tool. If the tool was installed using the Python Pip tool the following command will check the remote repository for updates, and apply it to your local system.
pip install awscli --upgrade
## Using aws cli commands
The syntax for using the aws cli is as follows:
aws [options] <command> <subcommand> [parameters]
Some examples using the ‘ec2’ command and the ‘describe-instances’ subcommand:
aws ec2 describe-instances aws ec2 describe-instances --instance-ids <your-id>
Example with a fake id:
aws ec2 describe-instances --instance-ids i-c71r246a
### IAM
#### Users
- <https://blogs.aws.amazon.com/security/post/Tx15CIT22V4J8RP/How-to-rotate-access-keys-for-IAM-users>
- <http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html>
- <http://docs.aws.amazon.com/cli/latest/reference/iam/index.html>
- Limits = 5000 users, 100 group, 250 roles, 2 access keys / user
aws iam list-users aws iam list-users --output text | cut -f 6 # list all users usernames aws iam list-users --no-paginate aws iam get-user # list current users info aws iam get-user --user-name aws-admin2 aws iam list-access-keys # list current users access keys aws iam create-user --user-name aws-admin2 # create new user aws iam delete-user --user-name aws-admin2
create multiple new users, from a file
allUsers=$(cat ./user-names.txt)
for userName in $allUsers; do
aws iam create-user \
--user-name $userName
done
## delete all users
# allUsers=$(aws iam list-users --output text | cut -f 6);
allUsers=$(cat ./user-names.txt)
for userName in $allUsers; do
aws iam delete-user \
--user-name $userName
done
#### Password policy
- <http://docs.aws.amazon.com/cli/latest/reference/iam/>
- <http://docs.aws.amazon.com/cli/latest/reference/iam/get-account-password-policy.html>
- <http://docs.aws.amazon.com/cli/latest/reference/iam/update-account-password-policy.html>
- <http://docs.aws.amazon.com/cli/latest/reference/iam/delete-account-password-policy.html>
aws iam get-account-password-policy # list policy aws iam delete-account-password-policy # delete policy
#### set policy
aws iam update-account-password-policy \
--minimum-password-length 12 \
--require-symbols \
--require-numbers \
--require-uppercase-characters \
--require-lowercase-characters \
--allow-users-to-change-password
#### Access Keys
- <http://docs.aws.amazon.com/cli/latest/reference/iam/>
aws iam list-access-keys # list all access keys aws iam list-access-keys --user-name aws-admin2 # list access keys of a specific user
create a new access key
aws iam create-access-key --user-name aws-admin2 --output text | tee aws-admin2.txt
list last access time of an access key
aws iam get-access-key-last-used --access-key-id AKIAINA6AJZY4EXAMPLE
deactivate an acccss key
aws iam update-access-key \
--access-key-id AKIAI44QH8DHBEXAMPLE \
--status Inactive \
--user-name aws-admin2
delete an access key
aws iam delete-access-key \
--access-key-id AKIAI44QH8DHBEXAMPLE \
--user-name aws-admin2
#### Groups, Policies, Managed Policies
- <http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html>
- <http://docs.aws.amazon.com/cli/latest/reference/iam/>
aws iam list-groups # list all groups aws iam create-group --group-name FullAdmins # create a group aws iam delete-group --group-name FullAdmins # delete a group aws iam list-policies # list all policies aws iam get-policy --policy-arn <value> # get a specific policy aws iam list-entities-for-policy --policy-arn <value> # list all users, groups, and roles, for a given policy aws iam list-attached-group-policies --group-name FullAdmins # list policies, for a given group aws iam get-group --group-name FullAdmins # list users, for a given group aws iam list-groups-for-user --user-name aws-admin2 # list groups, for a given user aws iam delete-group --group-name FullAdmins # delete a group aws iam add-user-to-group --group-name FullAdmins --user-name aws-admin2 # add a user to a group
add a policy to a group
aws iam attach-group-policy \
--group-name FullAdmins \
--policy-arn arn:aws:iam::aws:policy/AdministratorAccess
remove a user from a group
```
aws iam remove-user-from-group \ --group-name FullAdmins \ --user-name aws-admin2
```
remove a policy from a group
```
aws iam detach-group-policy \ --group-name FullAdmins \ --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
```
### Cloudwatch
#### Log Groups
- <http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/WhatIsCloudWatchLogs.html>
- <http://docs.aws.amazon.com/cli/latest/reference/logs/index.html>
- <http://docs.aws.amazon.com/cli/latest/reference/logs/create-log-group.html>
- <http://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html>
- <http://docs.aws.amazon.com/cli/latest/reference/logs/delete-log-group.html>
aws logs create-log-group --log-group-name "DefaultGroup" # create a group aws logs describe-log-groups # list all log groups aws logs describe-log-groups --log-group-name-prefix "Default" aws logs delete-log-group --log-group-name "DefaultGroup" # delete a group
### Log Streams
- <http://docs.aws.amazon.com/cli/latest/reference/logs/create-log-stream.html>
- <http://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-streams.html>
- <http://docs.aws.amazon.com/cli/latest/reference/logs/delete-log-stream.html>
Log group names can be between 1 and 512 characters long. Allowed characters include a-z, A-Z, 0-9, (underscore), ‘-’ (hyphen), ‘/’ (forward slash), and ‘.’ (period).
create a log stream
aws logs create-log-stream --log-group-name "DefaultGroup" --log-stream-name "syslog"
list details on a log stream
aws logs describe-log-streams --log-group-name "syslog" aws logs describe-log-streams --log-stream-name-prefix "syslog"
delete a log stream
aws logs delete-log-stream --log-group-name "DefaultGroup" --log-stream-name "Default Stream"
### Volumes & snapshots
aws ec2 delete-snapshot --snapshot-id snap-4e665454 aws ec2 describe-volumes aws ec2 attach-volume --instance-id i-dddddd70 --volume-id vol-1d5cc8cc --device /dev/sdh
Find all volumes not attached to any instance in all Regions
REGIONS=$(aws ec2 describe-regions --output text --query 'Regions[].[RegionName]')
for REGION in $REGIONS; do
echo $REGION
aws ec2 describe-volumes \
--filter "Name=status,Values=available" \
--query 'Volumes[*].{VolumeID:VolumeId,Size:Size,Type:VolumeType,AvailabilityZone:AvailabilityZone}' \
--region $REGION
done
Get the status of all volumes currently in the optimizing stage (after volume modification) in all Regions
for REGION in $REGIONS; do
echo $REGION
aws ec2 describe-volumes-modifications \
--query 'VolumesModifications[].{VolumeID:VolumeId,
TargetSize:TargetSize,
OriginalSize:OriginalSize,
Progress:Progress,
OriginalIops:OriginalIops,
TargetIops:TargetIops}' \
--output json \
--filter 'Name=modification-state,Values=optimizing' \
--region $REGION
done
Find all volumes in the “error” state in all Regions
for REGION in $REGIONS; do
echo $REGION
aws ec2 describe-volumes \
--filter "Name=status,Values=error" \
--query 'Volumes[*].{VolumeID:VolumeId,Size:Size,Type:VolumeType,
AvailabilityZone:AvailabilityZone}' \
--region $REGION;
done
Find all publicly available snapshots in an AWS account in all Regions
for REGION in $REGIONS; do
echo "$REGION:"
SNAPS=$(aws ec2 describe-snapshots --owner self --output json --region $REGION \
--query 'Snapshots[*].SnapshotId' --output text)
for snap in $SNAPS; do
aws ec2 describe-snapshot-attribute \
--snapshot-id $snap \
--region $REGION \
--output json \
--attribute createVolumePermission \
--query '[SnapshotId,CreateVolumePermissions[?Group == `all`]]' \
| jq -r '.[]'
done
echo
done
Find all snapshots over one month old. The following command lists all EBS snapshots using the describe-snapshots operation, where the timestamp is older than one month ( –date=‘-1 month’).
aws ec2 describe-snapshots --owner self --output json \ | jq '.Snapshots[] | select(.StartTime < "'$(date --date='-1 month' '+%Y-%m-%d')'") | [.Description, .StartTime, .SnapshotId]'
List snapshots over 1 month old in all Regions
for REGION in $REGIONS; do
echo $REGION
aws ec2 describe-snapshots \
--owner self \
--region $REGION \
--output json \
| jq '.Snapshots[] | select(.StartTime < "'$(date --date='-1 month' '+%Y-%m-%d')'") | [.Description, .StartTime, .SnapshotId]'
done
#### Instances
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/index.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instances.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/terminate-instances.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-instance-status.html>
aws ec2 describe-instance-status # list status of all instances aws ec2 reboot-instances --instance-ids i-dddddd70 aws ec2 start-instances --instance-ids i-dddddd70 aws ec2 stop-instances --instance-ids i-5c8282ed
create a new instance
aws ec2 run-instances \
--image-id ami-f0e7d19a \
--instance-type t2.micro \
--security-group-ids sg-00000000 \
--dry-run
aws ec2 run-instances --dry-run \
--image-id ami-08111162 \
--count 1 \
--instance-type t1.micro \
--key-name MyKeyPair \
--security-groups my-ami-security-group
aws ec2 run-instances \
--image-id ami-abcd1234 --count 1 --instance-type m3.medium \
--key-name my-key-pair --subnet-id subnet-abcd1234 --security-group-ids sg-abcd1234 \
--user-data file://myscript.txt
myscript.txt:
#!/bin/bash yum update -y service httpd start chkconfig httpd on
otro ejemplo
#!/bin/bash
yum update -y amazon-linux-extras install lamp-mariadb10.2-php7.2 \
php7.2 yum install httpd mariadb-server
systemctl start httpd
systemctl enable httpd
usermod -a -G apache ec2-user
chown -R ec2-user:apache /var/www
chmod 2775 /var/www
find /var/www -type d -exec chmod 2775 {} \;
find /var/www -type f -exec chmod 0664 {} \;
echo "<?php phpinfo(); ?>" > /var/www/html/phpinfo.php
Verify script results on /var/log/cloud-init-output.log
stop an instance
aws ec2 terminate-instances --instance-ids INSTANCEID aws ec2 terminate-instances --instance-ids --dry-run i-dddddd70
list status of a specific instance
aws ec2 describe-instances --instance-ids i-dddddd70
aws ec2 describe-instances \
--output text \
--query "Reservations[*].Instances[*].[Placement.AvailabilityZone,
State.Name,
InstanceType,
InstanceId,
Tags[?Key=='Name']|[0].Value,
Tags[?Key=='Gias_Name']|[0].Value]" \
--filters "Name=instance-state-name,Values=running,stopped" "Name=vpc-id,Values=XXX"
Modify attributes
aws ec2 modify-instance-attribute --instance-id i-44a44ac3 \
--instance-type "{\"Value\": \"m1.small\"}"
aws ec2 modify-instance-attribute --instance-id i-44a44ac3 --disable-api-termination
aws ec2 modify-instance-attribute --instance-id i-44a44ac3 --no-disable-api-termination
#### Images
aws ec2 create-image \
--instance-id i-44a44ac3 --name "Dev AMI" \
--description "AMI for development server"
aws ec2 describe-images --image-ids ami-2d574747
aws ec2 deregister-image --image-id ami-2d574747
#### Tags
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-tags.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/create-tags.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/delete-tags.html>
aws ec2 describe-tags # list the tags of an instance
add a tag to an instance
aws ec2 create-tags --resources "ami-1a2b3c4d" --tags Key=name,Value=debian aws ec2 create-tags --resources i-dddddd70 --tags Key=Department,Value=Finance
delete a tag on an instance
aws ec2 delete-tags --resources "ami-1a2b3c4d" --tags Key=Name,Value=
#### Console
aws ec2 get-console-output --instance-id i-44a44ac3 aws ec2 monitor-instances --instance-ids i-44a44ac3 aws ec2 unmonitor-instances --instance-ids i-44a44ac3
### Security Groups
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/index.html>
aws ec2 describe-security-groups aws ec2 create-security-group --vpc-id vpc-1a2b3c4d --group-name web-access --description "web access" aws ec2 describe-security-groups --group-id sg-0000000 aws ec2 delete-security-group --group-id sg-00000000
open port 80, for everyone
aws ec2 authorize-security-group-ingress \ --group-id sg-0000000 \ --protocol tcp \ --port 80 \ --cidr 0.0.0.0/24
get my public ip
my_ip=$(dig +short myip.opendns.com @resolver1.opendns.com); echo $my_ip
open port 22, just for my ip
aws ec2 authorize-security-group-ingress \ --group-id sg-0000000 \ --protocol tcp \ --port 80 \ --cidr $my_ip/24
remove a firewall rule from a group
aws ec2 revoke-security-group-ingress \ --group-id sg-0000000 \ --protocol tcp \ --port 80 \ --cidr 0.0.0.0/24
### Keypairs
- <http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-key-pairs.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/create-key-pair.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/import-key-pair.html>
- <http://docs.aws.amazon.com/cli/latest/reference/ec2/delete-key-pair.html>
aws ec2 describe-key-pairs aws ec2 create-key-pair --key-name dev-servers aws ec2 delete-key-pair --key-name dev-servers
create a new private / public keypair, using RSA 2048-bit
ssh-keygen -t rsa -b 2048
import an existing keypair
aws ec2 import-key-pair \
--key-name keyname_test \
--public-key-material file:///home/apollo/id_rsa.pub
### Profiles
To setup a new credential profile with the name myprofile :
aws configure --profile myprofile
AWS Access Key ID [None]: ACCESSKEY
AWS Secret Access Key [None]: SECRETKEY
Default region name [None]: REGIONNAME
Default output format [None]: text | table | json
For the AWS access key id and secret, create an IAM user in the AWS console and generate keys for it. Region will be the default region for commands in the format eu-west-1 or us-east-1 . The default output format can either be text , table or json . You can now use the profile name in other commands by using the –profile option, e.g.:
aws ec2 describe-instances --profile myprofile
AWS libraries for other languages (e.g. aws-sdk for Ruby or boto3 for Python) have options to use the profile you create with this method too. E.g. creating a new session in boto3 can be done like this, boto3.Session(profile\_name:‘myprofile’) and it will use the credentials you created for the profile.
The details of your aws-cli configuration can be found in \~/.aws/config and \~/.aws/credentials (on linux and mac-os). These details can be edited manually from there.
### S3
aws s3 --region eu-central-1 cp xxxxx s3://enel-staging-sc/lah/xxxxx --acl public-read aws s3 --region eu-central-1 cp s3://enel-staging-sc/lah/xxxxx xxxxx aws s3 --region eu-central-1 ls s3://enel-staging-sc/lah/xxxxx aws s3 --region eu-central-1 rm s3://enel-staging-sc/lah/xxxxx
Use a named profile
aws --profile myprofile s3 ls
List all objects in a bucket, including objects in folders, with size in human-readable format and a summary of the buckets properties in the end -
aws s3 ls --recursive --summarize --human-readable s3://<bucket_name>/
### Cloudtrail - Logging and Auditing
- <http://docs.aws.amazon.com/cli/latest/reference/cloudtrail/>
list all trails
aws cloudtrail describe-trails
create a new trail
aws cloudtrail create-subscription \
--name awslog \
--s3-new-bucket awslog2016
list the names of all trails
aws cloudtrail describe-trails --output text | cut -f 8
get the status of a trail
aws cloudtrail get-trail-status --name awslog
delete a trail
aws cloudtrail delete-trail --name awslog
delete the S3 bucket of a trail
aws s3 rb s3://awslog2016 --force
add tags to a trail, up to 10 tags
aws cloudtrail add-tags \
--resource-id awslog \
--tags-list "Key=log-type,Value=all"
list the tags of a trail
aws cloudtrail list-tags --resource-id-list
remove a tag from a trail
aws cloudtrail remove-tags \
--resource-id awslog \
--tags-list "Key=log-type,Value=all"
### Network Load Balancer
Create your load balancer
aws elbv2 create-load-balancer --name my-load-balancer --type network --subnets subnet-0e3f5cac72EXAMPLE
create a target group, specifying the same VPC that you used for your EC2 instances:
aws elbv2 create-target-group --name my-targets --protocol TCP \ --port 80 --vpc-id vpc-0598c7d356EXAMPLE
register your instances with your target group:
aws elbv2 register-targets --target-group-arn targetgroup-arn \ --targets Id=i-1234567890abcdef0 Id=i-0abcdef1234567890
create a listener for your load balancer with a default rule that forwards requests to your target group:
aws elbv2 create-listener --load-balancer-arn loadbalancer-arn --protocol TCP --port 80 \ --default-actions Type=forward,TargetGroupArn=targetgroup-arn
verify the health of the registered targets for your target group using this
aws elbv2 describe-target-health --target-group-arn targetgroup-arn
Specify an Elastic IP address for your load balancer
aws elbv2 create-load-balancer --name my-load-balancer --type network \ --subnet-mappings SubnetId=subnet-0e3f5cac72EXAMPLE,AllocationId=eipalloc-12345678
Delete your load balancer
aws elbv2 delete-load-balancer --load-balancer-arn loadbalancer-arn aws elbv2 delete-target-group --target-group-arn targetgroup-arn
### Others
aws glacier create-vault --account-id xxxxx --vault-name myvault aws sts get-caller-identity
### Get console output
A useful awscli feature is get-console-output which allows us to view the Linux console of an instance shortly after the instance boots. You will have to pipe the output of get-console-output into sed to correct line feeds and carriage returns.
```
$ aws ec2 get-console-output --instance-id i-0d9c2b31 \ | sed 's/\\n/\n/g' | sed
```
### Completer
```
which aws_completer /usr/local/bin/aws_completer
```
Bundled Installer – if you used the bundled installer per the instructions in the previous section, the AWS completer will be located in the bin subfolder of the installation directory.
```mixed ls /usr/local/aws/bin activate activate.csh activate.fish activate_this.py aws aws.cmd aws_completer ```
If all else fails, you can use find to search your entire file system for the AWS completer.
``` mixed $ find / -name aws_completer /usr/local/aws/bin/aws_completer ```
bash – use the built-in command complete.
``` sh complete -C '/usr/local/bin/aws_completer' aws ```
Note
/usr/local/bin is the default installation directory when you install the AWS CLI with pip. See Locate the AWS Completer (p. 14) if you are not sure where the AWS CLI was installed.
## AWSCLI v2
``` sh curl “https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip” -o “awscliv2.zip” unzip awscliv2.zip sudo ./aws/install ```