DEV Community

Cover image for Skipping the Console: Talking to IAM Through the AWS CLI
Hashir Saud Khan
Hashir Saud Khan

Posted on

Skipping the Console: Talking to IAM Through the AWS CLI

#aws #cli #iam #rhel

Install and Configure the AWS CLI

INTRO
If you've only ever clicked around the AWS Console, this one's for you. I set up the AWS CLI from scratch on a Red Hat Linux EC2 instance — not Amazon Linux, which comes with it pre-installed, but Red Hat, which doesn't. So I had to install it, connect it to my AWS account, and then use it to actually talk to IAM. Here's exactly how I did it.

WHAT YOU'RE BUILDING
Here's the picture: you SSH into an EC2 instance sitting inside a VPC. That instance gets the AWS CLI installed on it. Once it's configured with an access key, it can reach out and talk to IAM directly from the terminal — no console needed.

WHAT YOU'LL WALK AWAY WITH

  • The AWS CLI installed and working
  • The CLI connected to a real AWS account
  • Comfort using the CLI to query IAM instead of clicking through the console

AWS CLI version output showing successful installation in terminal

STEP 1: SSH INTO THE INSTANCE
First thing, you need to get onto the EC2 instance itself.

If you're on macOS or Linux, grab the PEM key, lock down its permissions, and connect:

cd ~/Downloads
chmod 400 labsuser.pem
ssh -i labsuser.pem ec2-user@<ip-address>
Enter fullscreen mode Exit fullscreen mode

Type yes when it asks about the connection — you're using a key pair, so no password needed.

If you're on Windows, you'll use PuTTY with the PPK file instead.

STEP 2: INSTALL THE AWS CLI
Once you're inside the instance, download and install the CLI:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip -u awscliv2.zip
sudo ./aws/install
Enter fullscreen mode Exit fullscreen mode

Check it worked:

aws --version
Enter fullscreen mode Exit fullscreen mode

You should see something like aws-cli/2.7.24 Python/3.8.8 Linux/... — exact version doesn't matter, just that it responds.

Try aws help too — if it opens up the help pager, you're good. Press q to get out.

STEP 3: LOOK AT THE IAM SETUP IN THE CONSOLE
Before jumping into the CLI, take a quick look at IAM in the console so you know what you're working with.

Go to IAM → Users → your user. Under Permissions, open the attached policy and view it as JSON — that's the actual permission document controlling what you can and can't do.

Then check the Security Credentials tab and find your access key ID. You'll need this (and the matching secret key) in the next step.

STEP 4: CONNECT THE CLI TO YOUR ACCOUNT
Back in the terminal, run:

aws configure
Enter fullscreen mode Exit fullscreen mode

It'll ask you four things:

  • Access Key ID — paste it in
  • Secret Access Key — paste it in
  • Default region — I used us-west-2
  • Default output format — json

That's it. Your terminal is now authenticated as your AWS user.

STEP 5: TALK TO IAM FROM THE TERMINAL
Now for the fun part — test it out:

aws iam list-users
Enter fullscreen mode Exit fullscreen mode

If everything's wired up right, you'll get back a JSON list of the IAM users in the account. No console, no clicking — just the CLI doing the work.

THE CHALLENGE: PULL THE POLICY DOCUMENT USING ONLY THE CLI
Here's where it gets interesting. The task: grab that same IAM policy document you looked at earlier in the console — but this time, do it entirely through the CLI. No cheating by going back to the console.

Two commands get you there. First, find the policy:

aws iam list-policies --scope Local
Enter fullscreen mode Exit fullscreen mode

--scope Local matters here — it filters down to customer-managed policies instead of dumping every AWS-managed policy at you.

Once you've got the policy's ARN and version ID from that output, pull the actual JSON and save it to a file:

aws iam get-policy-version --policy-arn arn:aws:iam::<account-id>:policy/lab_policy --version-id v1 > lab_policy.json
Enter fullscreen mode Exit fullscreen mode

That > at the end is doing the heavy lifting — it takes whatever the command prints and writes it straight into a file instead of just showing it on screen.

WHAT I TOOK AWAY FROM THIS

  • The CLI and the console aren't different tools — they're two doors into the same house. Everything you can click, you can also script
  • Logging into the console needs a username and password. Talking to AWS through the CLI needs an access key and secret key instead — different door, different key
  • list-policies --scope Local is worth remembering — without it, you're wading through every AWS-managed policy just to find the one you actually own
  • Piping CLI output into a file with > is a small thing, but it's how you turn a one-off command into something you can actually keep and review later

AWS #CLI #IAM #Linux #CloudComputing #DevOps

Top comments (0)