aws-cli

aws-cli Best Practices

The AWS CLI is your primary interface for programmatic interaction with AWS. Adhering to these best practices ensures your CLI usage is secure, reproducible, and efficient, aligning with modern DevOps principles.

1. Code Organization and Structure

Organize your AWS CLI interactions into well-defined scripts or functions. Avoid one-off commands for anything beyond simple queries.

1.1. Use Named Profiles for Environment Segregation

Always define multiple named profiles for different environments (e.g., dev, test, prod) and projects. This prevents accidental operations in the wrong account.

❌ BAD: Relying on default profile or constantly switching credentials.

# Easy to accidentally target production
aws s3 rm s3://my-prod-bucket --recursive

✅ GOOD: Explicitly using named profiles.

# ~/.aws/config
# [profile dev]
# region = us-east-1
# output = json

# [profile prod]
# region = us-east-1
# output = json

# In your script or terminal
aws s3 ls --profile dev
aws s3 rm s3://my-dev-bucket --recursive --profile dev

1.2. Pin AWS CLI Version in CI/CD

Ensure consistent behavior by pinning the AWS CLI version in automated environments. Use awscli-v2 for modern features and stability.

❌ BAD: Relying on the latest available version in CI/CD.

# .github/workflows/deploy.yml
# ...
# - name: Install AWS CLI
#   run: pip install awscli # Installs latest, potentially breaking changes

✅ GOOD: Using a specific, tested version (e.g., via Docker).

# .github/workflows/deploy.yml
# ...
- name: Deploy with AWS CLI v2
  uses: docker://amazon/aws-cli:2.15.30 # Pin to a specific, validated version
  with:
    args: s3 sync ./app s3://my-bucket-name --delete --profile prod

2. Common Patterns and Anti-patterns

Adopt patterns that promote automation, idempotency, and machine-readability.

2.1. Prefer JSON Output and jq for Parsing

Always output in json format and use jq for robust, idempotent parsing. Avoid parsing human-readable formats like text or table.