AWS CLI Quick Reference & Shortcuts

A curated collection of practical AWS CLI commands for day-to-day administration across ECR, IAM, S3, Route53, and STS.

---

📦 Amazon ECR Registry

export AWS_PROFILE="labs"
export AWS_REGION="eu-west-1"
export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

# 1. Authenticate Docker / Podman to Private ECR
aws ecr get-login-password --region $AWS_REGION \
  | docker login --username AWS --password-stdin ${ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com

# 2. Authenticate Helm to Private ECR (OCI)
aws ecr get-login-password --region $AWS_REGION \
  | helm registry login --username AWS --password-stdin ${ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com

# 3. Authenticate Helm to ECR Public Gallery
aws ecr-public get-login-password --region us-east-1 \
  | helm registry login --username AWS --password-stdin public.ecr.aws

# 4. List all image tags in a repository
aws ecr describe-images \
  --repository-name my-app \
  --query 'sort_by(imageDetails,&imagePushedAt)[*].[imageTags[0],imagePushedAt,imageSizeInBytes]' \
  --output table

# 5. List Helm chart OCI tags in ECR
aws ecr describe-images \
  --repository-name my-chart \
  --query 'imageDetails[?contains(imageManifestMediaType, `helm`)].imageTags[]' \
  --output text

---

🪣 Amazon S3

# Calculate total bucket size and object count
aws s3 ls s3://my-bucket --recursive --human-readable --summarize

# Sync local directory to S3 (excluding git files)
aws s3 sync ./dist s3://my-bucket/app/ --delete --exclude ".git/*"

# List top-level folders in an S3 bucket
aws s3 ls s3://my-bucket/

# Empty all versions and delete markers from a versioned bucket
aws s3api delete-objects \
  --bucket my-bucket \
  --delete "$(aws s3api list-object-versions --bucket my-bucket --query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}' --output json)"

---

🔐 IAM, STS & MFA

# Inspect current caller identity (Account, User/Role ARN)
aws sts get-caller-identity

# List virtual MFA devices attached to IAM users
aws iam list-virtual-mfa-devices --query 'VirtualMFADevices[*].[SerialNumber,User.UserName]' --output table

# Delete an inactive virtual MFA device
aws iam delete-virtual-mfa-device --serial-number arn:aws:iam::123456789012:mfa/user-mfa

# Generate temporary session token using MFA
aws sts get-session-token \
  --serial-number arn:aws:iam::123456789012:mfa/my-user \
  --token-code 123456

---

🌐 Route 53 DNS

# List all hosted zones
aws route53 list-hosted-zones --query 'HostedZones[*].[Id,Name,ResourceRecordSetCount]' --output table

# Query DNS records in a specific hosted zone
aws route53 list-resource-record-sets \
  --hosted-zone-id Z1234567890ABC \
  --query 'ResourceRecordSets[?Type==`A`].[Name,Type,TTL,ResourceRecords[0].Value]' \
  --output table