aws sysops 01 install cli

Installing the AWS Command Line Interface

Reference

Windows

Download and install the AWS CLI MSI installer for Windows

Linux and MacOS

Prerequisites

On MacOS install wget or use curl -O

$ brew install wget

Get python and pip

# MacOS
$ wget https://www.python.org/ftp/python/3.6.1/python-3.6.1-macosx10.6.pkg
$ sudo installer -pkg /path/to/python.pkg -target /

# Ubuntu
# NOTE: Replace “python” with “python3” for Python 3.
$ sudo apt-get install python-pip

# if required
$ wget https://bootstrap.pypa.io/get-pip.py
$ sudo python get-pip.py

Get AWS cli

$ pip install --upgrade --user awscli

# NOTE uninstall with
$ pip uninstall awscli

Configure AWS CLI PATH

Example AWS CLI install location on macOS: ~/Library/Python/2.7/bin

~/.bash_profile

# Add an export command to profile script.
export PATH=~/Library/Python/2.7/bin

$ source ~/.bash_profile

$ which aws
# ~/Library/Python/2.7/bin/aws

# Ubuntu: chmod +x to make the file executable.
$ chmod +x ~/Library/Python/2.7/bin/aws

$ aws --version
# aws-cli/1.11.84 Python/2.7.10 Darwin/16.1.0 botocore/1.5.47

Enable Command Completion

On Unix-like systems, the AWS CLI includes a command-completion feature that enables you to use the TAB key to complete a partially typed command. This feature is not automatically installed so you need to configure it manually.

$ which aws_completer
# ~/Library/Python/2.7/bin/aws_completer

$ complete -C '~/Library/Python/2.7/bin/aws_completer' aws

persist aws command completion

~/.bash_profile

# add this line to .bash_profile to persist aws command completion
complete -C '/usr/local/aws/bin/aws_completer' aws

Configure AWS CLI

Quick Configuration

$ aws configure

# example values
AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: eu-central-1
Default output format [None]: ENTER

multiple profiles

$ aws configure --profile userName

Configuration and Credential Files

path on Linux, macOS: ~/.aws path on Windows: %UserProfile%\.aws

~/.aws/credentials

[default]
aws_access_key_id=AKIAIOSFODNN7EXAMPLE
aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# aws_session_token – If using temporary security credentials.

[userName]
# ...

~/.aws/config

[default]
region=us-west-2
output=json # (json, text, or table)

[userName]
# ...

Using Profiles with the AWS CLI

$ aws ec2 describe-instances --profile userName

default profile

# Linux / MacOS
$ export AWS_DEFAULT_PROFILE=userName

# Windows
> set AWS_DEFAULT_PROFILE=userName

Usual Environment variables

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• AWS_SESSION_TOKEN
• AWS_DEFAULT_REGION
• AWS_DEFAULT_PROFILE
• AWS_CONFIG_FILE

Usual Command Line Options

• --profile
• --region
• --output
• --endpoint-url

EC2 Instance Metadata

To use the CLI from an EC2 instance:

1. create a role that has access to the resources needed and assign that role to the instance when it is launched.
2. Install the AWS CLI if necessary and configure a default region to avoid having to specify it in every command.
3. The AWS CLI will read credentials from the instance metadata

$ aws configure

# enter twice to skip the first two prompts
AWS Access Key ID [None]: ENTER
AWS Secret Access Key [None]: ENTER
Default region name [None]: us-west-2
Default output format [None]: json

Advanced: Using IAM Roles to authenticate AWS CLI profiles

Reference

The benefit of using the AWS CLI with IAM Roles to authenticate commands is that it avoids attaching permissions directly on users, which quicly get difficult to manage.

~/.aws/credentials

[default]
aws_access_key_id=AKIAIOSFODNN7EXAMPLE
aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

~/.aws/config

[profile sysops]
role_arn = arn:aws:iam::123456789012:role/sysops
source_profile = default

Note:

• A trust relationship must be defined on IAM Role to allow the IAM User to assume it
• IAM user must be granted the permission to assume the IAM Role
• IAM Role Tutorial