DEV Community

Cover image for AWS CLI: The Developer's Secret Weapon (And How to Keep It Secure)
Vikas Solegaonkar
Vikas Solegaonkar

Posted on • Originally published at yantratmika.com

AWS CLI: The Developer's Secret Weapon (And How to Keep It Secure)

Why the Terminal is Your Best Friend for AWS Management

If you've been managing AWS resources exclusively through the web console, you're not wrong—but you might be working harder than you need to. Let me show you why AWS CLI has become the go-to choice for developers who value speed, automation, and control.

The Web Console is Fine... Until It Isn't

Don't get me wrong—the AWS Management Console is beautifully designed. It's intuitive, visual, and perfect for exploring services you're learning. Amazon has invested millions into creating an interface that makes cloud computing accessible to everyone, and that's genuinely commendable.

But here's what happens in real-world development scenarios:

The Console Workflow:

  • Open browser → Wait for page load → Navigate to AWS → Multi-factor authentication dance → Find the right service from 200+ options → Click through multiple screens → Configure settings one field at a time → Wait for confirmation → Realize you need the exact same configuration in three other regions → Copy settings manually → Repeat for the next resource → Realize you need to do this 47 more times → Question your career choices → Consider becoming a farmer

The CLI Workflow:

aws ec2 run-instances --image-id ami-12345678 --count 50 --instance-type t2.micro --key-name MyKeyPair --region us-east-1
Enter fullscreen mode Exit fullscreen mode

One line. Fifty instances. Multiple regions with a simple loop. Five seconds total.

The difference isn't just speed—it's a fundamental shift in how you think about infrastructure management. The console trains you to think in clicks. The CLI trains you to think in systems.

Why Smart Developers Choose CLI

1. Speed That Actually Matters

When you're deploying infrastructure, troubleshooting issues at 2 AM, or managing resources across multiple AWS accounts and regions, every second compounds. With CLI, you can:

  • Launch dozens of resources in milliseconds instead of minutes
  • Query multiple services simultaneously across regions
  • Filter and process output instantly with powerful tools like jq, grep, awk, or sed
  • Chain commands together for complex workflows
  • Build muscle memory for common operations

Let me give you a concrete example. Yesterday, I needed to find all EC2 instances across four regions that were running but had been inactive for more than 30 days. In the console, this would have meant:

  • Switching between four region dropdowns
  • Manually checking each instance's metrics
  • Copy-pasting instance IDs into a spreadsheet
  • Cross-referencing with CloudWatch
  • Probably 45 minutes of tedious clicking

With CLI:

for region in us-east-1 us-west-2 eu-west-1 ap-southeast-1; do
  aws ec2 describe-instances --region $region \
    --filters "Name=instance-state-name,Values=running" \
    --query 'Reservations[*].Instances[*].[InstanceId,LaunchTime]' \
    --output text | while read id launch_time; do
      # Check if instance is older than 30 days
      if [[ $(date -d "$launch_time" +%s) -lt $(date -d '30 days ago' +%s) ]]; then
        echo "$region: $id (launched: $launch_time)"
      fi
    done
done
Enter fullscreen mode Exit fullscreen mode

Two minutes to write. Instant execution. Complete results.

2. Automation and Scripting: Where CLI Becomes Indispensable

This is where the CLI doesn't just save time—it enables entirely new workflows. Let me show you some real-world automation that simply isn't possible with the console:

Automated Backup Script:

#!/bin/bash
# Daily backup script for all RDS instances
BACKUP_DATE=$(date +%Y%m%d-%H%M%S)

# Get all RDS instances
for db in $(aws rds describe-db-instances \
  --query 'DBInstances[*].DBInstanceIdentifier' \
  --output text); do

  echo "Creating snapshot for $db..."
  aws rds create-db-snapshot \
    --db-instance-identifier $db \
    --db-snapshot-identifier "${db}-backup-${BACKUP_DATE}"

  # Tag the snapshot
  aws rds add-tags-to-resource \
    --resource-name "arn:aws:rds:us-east-1:123456789012:snapshot:${db}-backup-${BACKUP_DATE}" \
    --tags Key=AutomatedBackup,Value=true Key=Date,Value=$BACKUP_DATE

  # Clean up snapshots older than 30 days
  aws rds describe-db-snapshots \
    --db-instance-identifier $db \
    --query "DBSnapshots[?SnapshotCreateTime<='$(date -d '30 days ago' --iso-8601)'].DBSnapshotIdentifier" \
    --output text | while read old_snapshot; do
      echo "Deleting old snapshot: $old_snapshot"
      aws rds delete-db-snapshot --db-snapshot-identifier $old_snapshot
    done
done

echo "Backup process completed at $(date)"
Enter fullscreen mode Exit fullscreen mode

Schedule this with cron, and you have enterprise-grade backup automation. Try doing that with the console.

Cost Optimization Script:

#!/bin/bash
# Find and stop all EC2 instances with the tag "Environment:Development" after 6 PM

CURRENT_HOUR=$(date +%H)

if [ $CURRENT_HOUR -ge 18 ]; then
  aws ec2 describe-instances \
    --filters "Name=tag:Environment,Values=Development" \
              "Name=instance-state-name,Values=running" \
    --query 'Reservations[*].Instances[*].InstanceId' \
    --output text | while read instance; do
      echo "Stopping development instance: $instance"
      aws ec2 stop-instances --instance-ids $instance

      # Send notification
      aws sns publish \
        --topic-arn "arn:aws:sns:us-east-1:123456789012:cost-savings" \
        --message "Stopped development instance $instance at $(date)"
    done
fi
Enter fullscreen mode Exit fullscreen mode

This single script can save thousands of dollars per month by automatically shutting down development environments during non-business hours.

3. Version Control for Infrastructure

Your CLI commands live in scripts. Scripts live in Git. Suddenly, your infrastructure changes have:

  • Full audit history - Every infrastructure change is a git commit with timestamps and authors
  • Code review processes - Changes go through pull requests before reaching production
  • Rollback capabilities - git revert becomes your infrastructure undo button
  • Team collaboration - Everyone can see, review, and improve infrastructure code
  • Documentation - The scripts themselves document how your infrastructure works

Here's a real example of infrastructure as code using AWS CLI:

#!/bin/bash
# vpc-setup.sh - Creates a complete VPC environment

# Create VPC
VPC_ID=$(aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=Production-VPC}]' \
  --query 'Vpc.VpcId' \
  --output text)

echo "Created VPC: $VPC_ID"

# Create Internet Gateway
IGW_ID=$(aws ec2 create-internet-gateway \
  --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=Production-IGW}]' \
  --query 'InternetGateway.InternetGatewayId' \
  --output text)

aws ec2 attach-internet-gateway --vpc-id $VPC_ID --internet-gateway-id $IGW_ID
echo "Created and attached Internet Gateway: $IGW_ID"

# Create public subnet
PUBLIC_SUBNET_ID=$(aws ec2 create-subnet \
  --vpc-id $VPC_ID \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=Public-Subnet-1a}]' \
  --query 'Subnet.SubnetId' \
  --output text)

echo "Created public subnet: $PUBLIC_SUBNET_ID"

# Create private subnet
PRIVATE_SUBNET_ID=$(aws ec2 create-subnet \
  --vpc-id $VPC_ID \
  --cidr-block 10.0.2.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=Private-Subnet-1a}]' \
  --query 'Subnet.SubnetId' \
  --output text)

echo "Created private subnet: $PRIVATE_SUBNET_ID"

# Create route table for public subnet
ROUTE_TABLE_ID=$(aws ec2 create-route-table \
  --vpc-id $VPC_ID \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=Public-RT}]' \
  --query 'RouteTable.RouteTableId' \
  --output text)

# Add route to Internet Gateway
aws ec2 create-route \
  --route-table-id $ROUTE_TABLE_ID \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id $IGW_ID

# Associate route table with public subnet
aws ec2 associate-route-table \
  --subnet-id $PUBLIC_SUBNET_ID \
  --route-table-id $ROUTE_TABLE_ID

echo "VPC setup complete!"
echo "VPC ID: $VPC_ID"
echo "Public Subnet: $PUBLIC_SUBNET_ID"
echo "Private Subnet: $PRIVATE_SUBNET_ID"
Enter fullscreen mode Exit fullscreen mode

This script is now your documentation, your deployment process, and your disaster recovery plan all in one. Version it, review it, and deploy with confidence.

4. Consistency Across Environments

Same commands work identically whether you're managing:

  • Development environment on your laptop at the coffee shop
  • Staging from CI/CD pipelines running on Jenkins
  • Production from your deployment tools in the data center
  • Disaster recovery in a completely different region

No UI differences to navigate. No "where did they move that button in the new console update?" frustrations. No regional console quirks. Just consistent, reliable command execution.

5. Power User Efficiency: Unlocking Advanced Capabilities

Once you learn the patterns, you become unstoppable. Here are some power user techniques:

Finding Untagged Resources (Cost Management Gold):

# Find all untagged EC2 instances
aws ec2 describe-instances \
  --query 'Reservations[*].Instances[?!Tags].{ID:InstanceId,Type:InstanceType,State:State.Name}' \
  --output table

# Find all S3 buckets without proper tags
aws s3api list-buckets --query 'Buckets[*].Name' --output text | while read bucket; do
  tags=$(aws s3api get-bucket-tagging --bucket $bucket 2>/dev/null)
  if [ -z "$tags" ]; then
    echo "Untagged bucket: $bucket"
  fi
done
Enter fullscreen mode Exit fullscreen mode

Cross-Region Resource Management:

# List all running instances across ALL regions
for region in $(aws ec2 describe-regions --query 'Regions[*].RegionName' --output text); do
  echo "Checking region: $region"
  aws ec2 describe-instances \
    --region $region \
    --filters "Name=instance-state-name,Values=running" \
    --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,Tags[?Key==`Name`].Value|[0]]' \
    --output table
done
Enter fullscreen mode Exit fullscreen mode

Advanced S3 Operations:

# Find large S3 buckets (>100GB) and calculate their actual cost
aws s3api list-buckets --query 'Buckets[*].Name' --output text | while read bucket; do
  echo "Analyzing bucket: $bucket"

  # Get total size
  size=$(aws s3 ls s3://$bucket --recursive --summarize | grep "Total Size" | awk '{print $3}')

  if [ -n "$size" ] && [ $size -gt 107374182400 ]; then
    size_gb=$((size / 1073741824))
    estimated_cost=$(echo "scale=2; $size_gb * 0.023" | bc)
    echo "$bucket: ${size_gb}GB (~\$${estimated_cost}/month)"

    # Get object count
    count=$(aws s3 ls s3://$bucket --recursive --summarize | grep "Total Objects" | awk '{print $3}')
    echo "  Objects: $count"

    # Check versioning
    versioning=$(aws s3api get-bucket-versioning --bucket $bucket --query 'Status' --output text)
    echo "  Versioning: $versioning"
  fi
done
Enter fullscreen mode Exit fullscreen mode

Security Auditing:

# Find all publicly accessible S3 buckets (security nightmare detector)
for bucket in $(aws s3api list-buckets --query 'Buckets[*].Name' --output text); do
  block_public=$(aws s3api get-public-access-block --bucket $bucket 2>/dev/null)

  if [ $? -ne 0 ]; then
    echo "⚠️  WARNING: $bucket has no public access block!"

    # Check bucket ACL
    acl=$(aws s3api get-bucket-acl --bucket $bucket --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' --output text)
    if [ -n "$acl" ]; then
      echo "   🚨 CRITICAL: Public ACL detected on $bucket!"
    fi
  fi
done
Enter fullscreen mode Exit fullscreen mode

Getting Started with AWS CLI: A Complete Tutorial

Now that you're convinced (I hope), let's get you set up with AWS CLI and running your first commands. This section will take you from zero to proficient.

Installation

On macOS:

# Using Homebrew (recommended)
brew install awscli

# Verify installation
aws --version
Enter fullscreen mode Exit fullscreen mode

On Linux:

# Using the official installer
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Verify installation
aws --version
Enter fullscreen mode Exit fullscreen mode

On Windows:
Download the MSI installer from the official AWS CLI page and run it. Or use the command line:

# Using Windows Package Manager
winget install Amazon.AWSCLI

# Verify installation
aws --version
Enter fullscreen mode Exit fullscreen mode

You should see output like: aws-cli/2.x.x Python/3.x.x Linux/5.x.x

Configuration: Setting Up Your Credentials

Before you can use AWS CLI, you need to configure your credentials. First, create an IAM user in the AWS Console with programmatic access:

  1. Go to IAM → Users → Add User
  2. Give it a name (e.g., "cli-admin")
  3. Select "Access key - Programmatic access"
  4. Attach appropriate permissions (for learning, you can use AdministratorAccess, but in production, use least privilege)
  5. Save the Access Key ID and Secret Access Key

Now configure your CLI:

aws configure
Enter fullscreen mode Exit fullscreen mode

You'll be prompted for:

AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-east-1
Default output format [None]: json
Enter fullscreen mode Exit fullscreen mode

Pro Tips:

  • Use json for scripting, table for human readability, or text for parsing
  • You can have multiple profiles: aws configure --profile production
  • Switch profiles with: export AWS_PROFILE=production

Your First AWS CLI Commands

Let's start with some basic commands to get comfortable:

1. Check Your Identity:

aws sts get-caller-identity
Enter fullscreen mode Exit fullscreen mode

Output:

{
    "UserId": "AIDAI123456789EXAMPLE",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/cli-admin"
}
Enter fullscreen mode Exit fullscreen mode

This confirms you're authenticated and shows which account you're using.

2. List S3 Buckets:

aws s3 ls
Enter fullscreen mode Exit fullscreen mode

Output:

2024-01-15 10:23:45 my-application-logs
2024-02-20 14:56:12 company-backups
2024-03-10 09:15:33 static-website-assets
Enter fullscreen mode Exit fullscreen mode

3. List EC2 Instances:

aws ec2 describe-instances --output table
Enter fullscreen mode Exit fullscreen mode

This gives you a nicely formatted table of all your EC2 instances.

4. Get Specific Information with Queries:

# List only running instances with their IDs and types
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name]' \
  --output table
Enter fullscreen mode Exit fullscreen mode

Output:

-----------------------------------------
|         DescribeInstances             |
+----------------------+----------------+----------+
|  i-1234567890abcdef0 |  t2.micro      |  running |
|  i-0987654321fedcba0 |  t2.small      |  running |
+----------------------+----------------+----------+
Enter fullscreen mode Exit fullscreen mode

Practical Tutorial: Complete Workflows

Let's walk through some complete, real-world scenarios:

Scenario 1: Creating and Hosting a Static Website on S3 

# Step 1: Create a bucket
BUCKET_NAME="my-awesome-website-$(date +%s)"
aws s3 mb s3://$BUCKET_NAME --region us-east-1

# Step 2: Enable static website hosting
aws s3 website s3://$BUCKET_NAME/ --index-document index.html --error-document error.html

# Step 3: Create a simple index.html
cat > index.html << EOF
<!DOCTYPE html>
<html>
<head><title>My AWS CLI Website</title></head>
<body>
  <h1>Hello from AWS CLI!</h1>
  <p>This website was created entirely with command line tools.</p>
</body>
</html>
EOF

# Step 4: Upload the file
aws s3 cp index.html s3://$BUCKET_NAME/

# Step 5: Make it public (bucket policy)
cat > bucket-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "PublicReadGetObject",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::$BUCKET_NAME/*"
  }]
}
EOF

aws s3api put-bucket-policy --bucket $BUCKET_NAME --policy file://bucket-policy.json

# Step 6: Get the website URL
echo "Your website is live at: http://$BUCKET_NAME.s3-website-us-east-1.amazonaws.com"
Enter fullscreen mode Exit fullscreen mode

Boom. You just created and deployed a website in 30 seconds. Try doing that with the console.

Scenario 2: Launching an EC2 Instance with All the Trimmings 

# Step 1: Create a security group
SG_ID=$(aws ec2 create-security-group \
  --group-name my-web-server-sg \
  --description "Security group for web server" \
  --query 'GroupId' \
  --output text)

echo "Created security group: $SG_ID"

# Step 2: Add ingress rules
aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp \
  --port 22 \
  --cidr 0.0.0.0/0 # SSH (WARNING: restrict this in production!)

aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0 # HTTP

aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0 # HTTPS

# Step 3: Create a key pair
aws ec2 create-key-pair \
  --key-name my-web-server-key \
  --query 'KeyMaterial' \
  --output text > my-web-server-key.pem

chmod 400 my-web-server-key.pem
echo "Created key pair: my-web-server-key.pem"

# Step 4: Create user data script for auto-configuration
cat > user-data.sh << 'EOF'
#!/bin/bash
yum update -y
yum install -y httpd
systemctl start httpd
systemctl enable httpd
echo "<h1>Hello from AWS CLI-created instance!</h1>" > /var/www/html/index.html
EOF

# Step 5: Launch the instance
INSTANCE_ID=$(aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t2.micro \
  --key-name my-web-server-key \
  --security-group-ids $SG_ID \
  --user-data file://user-data.sh \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=MyWebServer}]' \
  --query 'Instances[0].InstanceId' \
  --output text)

echo "Launched instance: $INSTANCE_ID"

# Step 6: Wait for it to be running
aws ec2 wait instance-running --instance-ids $INSTANCE_ID
echo "Instance is now running!"

# Step 7: Get the public IP
PUBLIC_IP=$(aws ec2 describe-instances \
  --instance-ids $INSTANCE_ID \
  --query 'Reservations[0].Instances[0].PublicIpAddress' \
  --output text)

echo "Your web server is accessible at: http://$PUBLIC_IP"
Enter fullscreen mode Exit fullscreen mode

This entire workflow—from zero to a running, configured web server—takes about 2 minutes with the CLI. With the console, you'd still be clicking through wizards.

Scenario 3: Database Backup and Restore 

# Create a snapshot of an RDS database
aws rds create-db-snapshot \
  --db-instance-identifier my-production-db \
  --db-snapshot-identifier manual-backup-$(date +%Y%m%d-%H%M%S)

# List all snapshots for this database
aws rds describe-db-snapshots \
  --db-instance-identifier my-production-db \
  --query 'DBSnapshots[*].[DBSnapshotIdentifier,SnapshotCreateTime,Status]' \
  --output table

# Restore from a snapshot
aws rds restore-db-instance-from-db-snapshot \
  --db-instance-identifier my-restored-db \
  --db-snapshot-identifier manual-backup-20241207-143022 \
  --db-instance-class db.t3.micro

# Monitor the restore progress
aws rds describe-db-instances \
  --db-instance-identifier my-restored-db \
  --query 'DBInstances[0].[DBInstanceStatus,Endpoint.Address]' \
  --output table
Enter fullscreen mode Exit fullscreen mode

Scenario 4: Cost Monitoring and Cleanup 

# Find all stopped instances (you're paying for their EBS volumes!)
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=stopped" \
  --query 'Reservations[*].Instances[*].[InstanceId,Tags[?Key==`Name`].Value|[0],LaunchTime]' \
  --output table

# Terminate old stopped instances
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=stopped" \
  --query 'Reservations[*].Instances[*].InstanceId' \
  --output text | while read instance; do
    echo "Terminating: $instance"
    aws ec2 terminate-instances --instance-ids $instance
done

# Find unattached EBS volumes (costing you money for nothing!)
aws ec2 describe-volumes \
  --filters "Name=status,Values=available" \
  --query 'Volumes[*].[VolumeId,Size,CreateTime]' \
  --output table

# Delete them after confirmation
aws ec2 describe-volumes \
  --filters "Name=status,Values=available" \
  --query 'Volumes[*].VolumeId' \
  --output text | while read volume; do
    echo "Do you want to delete $volume? (y/n)"
    read answer
    if [ "$answer" = "y" ]; then
      aws ec2 delete-volume --volume-id $volume
      echo "Deleted $volume"
    fi
done
Enter fullscreen mode Exit fullscreen mode

Advanced CLI Techniques

Using JQ for JSON Processing:

# Install jq first: brew install jq (macOS) or apt-get install jq (Linux)

# Get detailed instance information in a custom format
aws ec2 describe-instances | jq '.Reservations[].Instances[] | {
  id: .InstanceId,
  type: .InstanceType,
  state: .State.Name,
  ip: .PublicIpAddress,
  name: (.Tags[]? | select(.Key=="Name") | .Value)
}'
Enter fullscreen mode Exit fullscreen mode

Creating Reusable Functions:
Add these to your .bashrc or .zshrc:

# Quick instance lookup by name
ec2-find() {
  aws ec2 describe-instances \
    --filters "Name=tag:Name,Values=*$1*" \
    --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name,PublicIpAddress]' \
    --output table
}

# Usage: ec2-find webserver

# Quick S3 bucket size check
s3-size() {
  aws s3 ls s3://$1 --recursive --summarize | grep "Total Size" | awk '{print $3/1024/1024/1024 " GB"}'
}

# Usage: s3-size my-bucket-name

# Get current AWS spending this month
aws-cost() {
  aws ce get-cost-and-usage \
    --time-period Start=$(date -d "$(date +%Y-%m-01)" +%Y-%m-%d),End=$(date +%Y-%m-%d) \
    --granularity MONTHLY \
    --metrics "UnblendedCost" \
    --query 'ResultsByTime[*].[TimePeriod.Start,Total.UnblendedCost.Amount]' \
    --output table
}
Enter fullscreen mode Exit fullscreen mode

The Real-World Impact

I've seen teams reduce deployment times from 30 minutes of console clicking to 30 seconds of script execution. I've watched developers troubleshoot production issues while commuting using nothing but a terminal on their phone. I've experienced the satisfaction of automating away repetitive tasks that used to eat hours of my week.

One team I worked with automated their entire DR (Disaster Recovery) runbook using AWS CLI scripts. What used to be a 40-page manual process requiring 6 hours and multiple people became a single command:

./disaster-recovery.sh --region us-west-2 --restore-from latest
Enter fullscreen mode Exit fullscreen mode

Their RTO (Recovery Time Objective) went from 6 hours to 45 minutes. That's the power of CLI automation.

But There's One Problem We Need to Talk About

AWS CLI is powerful. It's efficient. It's the professional choice for managing cloud infrastructure at scale. It's the difference between being a button-clicker and being an infrastructure engineer.

And it's also a significant security risk sitting on your laptop right now.

The Credential Problem Nobody Talks About

When you configure AWS CLI using aws configure, your credentials are stored in plain text files on your disk:

~/.aws/credentials
~/.aws/config
Enter fullscreen mode Exit fullscreen mode

Let's look at what's actually in these files:

$ cat ~/.aws/credentials
[default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

[production]
aws_access_key_id = AKIAI44QH8DHBEXAMPLE
aws_secret_access_key = je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
Enter fullscreen mode Exit fullscreen mode

These files contain your AWS access keys—the literal keys to your kingdom. And they're just... sitting there. Unencrypted. On your disk. In plain text. Readable by any process, any script, any malware.

Think about what that means:

🔓 Any malware that infects your laptop has immediate access - Cryptominers, ransomware, data exfiltration tools—they all scan for AWS credentials as their first step.

🔓 Any script you run can read them - That npm package you just installed? That Python script from Stack Overflow? They can all access your AWS credentials without you knowing.

🔓 Anyone with physical access to your machine can copy them - Dropped your laptop at the coffee shop? Someone at the repair shop? Your credentials are just sitting there.

🔓 If your laptop is stolen, your AWS account is compromised - The thief doesn't need to crack your AWS password—they already have permanent access keys.

🔓 Backup systems might sync these credentials to the cloud unencrypted - Dropbox, Google Drive, Time Machine—they're backing up your .aws folder right now.

🔓 Git repositories accidentally expose them - How many times have you seen someone commit their .aws folder to a public repo? It happens more than you think.

This Isn't Theoretical—It's Happening Right Now

Let me share some real incidents I've witnessed or heard from colleagues:

Case 1: The $72,000 Bitcoin Mining Operation
A developer's laptop got infected with malware that specifically hunted for AWS credentials. Within 18 hours, the attacker had spun up 300 GPU instances across multiple regions to mine cryptocurrency. The bill? $72,000. The company's AWS account was banned for abuse. The developer? Let go.

The malware was sophisticated—it detected when the user was idle, spun up resources, and shut them down just before the user came back. It took three days to notice because CloudWatch alarms weren't configured properly.

Case 2: The Complete S3 Exfiltration
An intern downloaded a "productivity tool" that turned out to be malware. It scanned for .aws/credentials files, found them, and systematically downloaded every S3 bucket in the account—including 300GB of customer PII. The company had to notify 2.3 million customers of a data breach. The regulatory fines alone exceeded $15 million.

Case 3: The Cryptojacking Attack
A senior engineer's laptop was compromised at a conference via public WiFi. The attacker waited six months before activating, making it nearly impossible to trace. When they finally struck, they deleted all production databases and left a ransom note. Because the credentials were persistent and never rotated, the six-month-old breach was still viable.

Case 4: The Accidental GitHub Commit
A developer was working on a side project and accidentally committed their .aws folder to a public GitHub repository. Within 45 minutes, automated bots found the credentials and started launching instances. The developer only noticed when they got an AWS bill notification for $5,000—for resources launched in the past hour.

Why This Problem is Worse Than You Think

Unlike the AWS web console which:

  • Uses session tokens that expire
  • Requires re-authentication periodically
  • Has MFA protection
  • Logs you out after inactivity
  • Uses HTTPS for all communications

Your CLI credentials are:

  • Permanent until you manually rotate them
  • Always active even when you're not using them
  • Unprotected by any additional authentication layer
  • Stored in plain text without any encryption
  • Accessible system-wide to any process

It's like leaving your house keys under the doormat and then being surprised when someone walks in.

The Industry's Half-Solutions (And Why They Don't Work)

You might have heard the standard security advice. Let's examine why each one falls short:

"Use IAM roles!"

  • ✅ Great for EC2 instances, Lambda functions, and other AWS services
  • ❌ Doesn't help with your laptop—IAM roles don't work for local development
  • ❌ Still need long-term credentials for local CLI usage

"Rotate your keys frequently!"

  • ✅ Limits the window of exposure
  • ❌ Credentials are still stored in plain text between rotations
  • ❌ Doesn't prevent the initial compromise
  • ❌ Creates operational overhead that teams often skip

"Use AWS SSO!"

  • ✅ Better authentication flow
  • ❌ Adds significant complexity to daily workflows
  • ❌ Doesn't work for all use cases (CI/CD, automated scripts)
  • ❌ Still stores temporary credentials in plain text
  • ❌ Many organizations don't have SSO configured

"Use temporary credentials!"

  • ✅ Limited time window for exploitation
  • ❌ Requires constant re-authentication (terrible UX)
  • ❌ Breaks automated workflows and scripts
  • ❌ Temporary credentials are still stored in plain text

"Use AWS Vault or similar tools!"

  • ✅ Better than nothing
  • ❌ Complex setup and configuration
  • ❌ Requires changing your entire workflow
  • ❌ Limited Windows support
  • ❌ Steep learning curve for team adoption

"Just use MFA for everything!"

  • ✅ Adds an authentication layer
  • ❌ Doesn't protect credentials at rest
  • ❌ Doesn't stop malware from using stolen credentials
  • ❌ Annoying for every CLI command

These solutions help, but none of them solve the fundamental problem: your credentials are stored in plain text on your disk.

It's like putting a better lock on your front door while leaving the window wide open.

What You Actually Need

What if you could have all the speed and power of AWS CLI with actually secure credential storage? What if your AWS keys were encrypted at rest and only decrypted at the exact moment you need them? What if this worked seamlessly without changing your workflow?

That's exactly what AWS Credential Manager provides.

The Solution: Encrypted Credentials That Actually Work

AWS Credential Manager takes a different approach. Instead of trying to work around the credential storage problem, it solves it directly.

How It Works

The architecture is elegantly simple:

  1. Encrypted Storage - Your AWS credentials are encrypted using Windows Credential Manager with DPAPI (Data Protection API), the same technology Windows uses to protect your passwords, certificates, and other sensitive data.

  2. On-Demand Decryption - Credentials are only decrypted when you actually run an AWS CLI command. Not when you boot your computer. Not when you're browsing the web. Only when needed.

  3. Immediate Re-Encryption - As soon as your command completes, credentials are locked back up. The window of exposure is measured in milliseconds, not hours or days.

  4. Zero Workflow Change - You still run aws s3 ls, aws ec2 describe-instances, or any other AWS CLI command exactly as before. Your scripts don't change. Your muscle memory doesn't change. Everything just works.

The Technical Details (For the Curious)

Here's what happens under the hood when you run an AWS command:

1. You type: aws s3 ls
2. AWS Credential Manager intercepts the command
3. Credentials are decrypted from Windows Credential Manager (DPAPI)
4. Temporary credentials are injected into the AWS CLI environment
5. Your command executes normally
6. Credentials are immediately purged from memory
7. Your encrypted credentials remain safe on disk
Enter fullscreen mode Exit fullscreen mode

This means:

  • Malware scanning your disk finds only encrypted data
  • Scripts reading ~/.aws/credentials find nothing
  • Backup systems sync only encrypted credentials
  • Physical theft doesn't expose your AWS account
  • Accidental git commits don't leak credentials

But your actual AWS CLI usage is identical to before.

The Setup Process

Getting started takes about 60 seconds:

# 1. Install from Microsoft Store (ensures authenticity and auto-updates)
# Download: https://apps.microsoft.com/store/detail/9NWNQ88V1P86?cid=DevShareMCLPCS

# 2. Configure your credentials (one-time setup)
aws-credential-manager configure

# You'll be prompted for:
# - AWS Access Key ID
# - AWS Secret Access Key
# - Default region
# - Default output format

# 3. Use AWS CLI exactly as before
aws s3 ls
aws ec2 describe-instances
aws rds describe-db-instances

# That's it. Everything works, but now it's secure.
Enter fullscreen mode Exit fullscreen mode

Your credentials are now encrypted. Your workflow hasn't changed. Your scripts still work. Your automation still runs. But your AWS account is actually protected.

Real-World Benefits

For Individual Developers:

  • Sleep better knowing your personal AWS account isn't at risk
  • Work on coffee shop WiFi without worry
  • Install new tools and packages without fear
  • Commit your scripts to GitHub without double-checking for credentials

For Development Teams:

  • Enforce security without slowing down developers
  • Meet compliance requirements (SOC 2, ISO 27001, etc.)
  • Reduce incident response costs
  • Enable secure laptop sharing or rotation

For Security Teams:

  • Eliminate the #1 AWS credential exposure vector
  • Reduce attack surface without user friction
  • Prevent credential-based breaches before they happen
  • Get audit logs of credential access

Why This Matters More Than Ever

Your laptop is your most vulnerable attack surface. It:

  • Travels with you everywhere
  • Connects to untrusted networks (coffee shops, airports, conferences)
  • Runs experimental code and scripts
  • Installs third-party packages and dependencies
  • Has at least one questionable browser extension installed
  • Gets handed to IT for repairs or troubleshooting
  • Might get lost or stolen

Every one of these scenarios is a potential AWS credential exposure if you're using plain text storage.

You wouldn't leave your house keys under the doormat.

You wouldn't write your bank password on a sticky note.

Don't leave your AWS keys in plain text.

The Cost of Not Securing Your Credentials

Let's do some quick math:

  • Average AWS breach cost: $50,000 - $500,000 (depending on resources launched)
  • Average time to detect: 3-7 days
  • Cost of incident response: $10,000 - $50,000
  • Potential data breach: $Millions in fines and reputation damage
  • Career impact: Potentially devastating

Compare that to:

  • Cost of AWS Credential Manager: Free
  • Setup time: 60 seconds
  • Workflow disruption: Zero
  • Peace of mind: Priceless

It's not a question of if your laptop will be compromised—it's when. And when it happens, do you want your AWS credentials to be an open book or encrypted and secure?

The Bottom Line: Professional Tools Deserve Professional Security

AWS CLI is the right tool for professional AWS management. It's faster, more powerful, more automatable, and more flexible than the web console. Once you master it, you'll wonder how you ever lived without it.

But using it securely requires one additional step—one that should have been built into AWS CLI from the start but wasn't.

AWS Credential Manager is that missing piece. It's the protection layer that lets you use AWS CLI with the speed and efficiency you need and the security you must have.

Think of it this way: you wouldn't drive a race car without seatbelts. You wouldn't run production infrastructure without backups. And you shouldn't use AWS CLI without encrypted credential storage.

Your credentials are the keys to your infrastructure.

Your infrastructure is the foundation of your business.

Protect both.

Get AWS Credential Manager from Microsoft Store →

Quick Reference: Essential AWS CLI Commands

Here's a cheat sheet of commands you'll use constantly:

# Identity and Configuration
aws sts get-caller-identity              # Who am I?
aws configure list                       # Show current configuration

# S3 Operations
aws s3 ls                                # List buckets
aws s3 ls s3://bucket-name               # List bucket contents
aws s3 cp file.txt s3://bucket/          # Upload file
aws s3 sync ./local s3://bucket/path     # Sync directory

# EC2 Management
aws ec2 describe-instances               # List all instances
aws ec2 start-instances --instance-ids i-xxx
aws ec2 stop-instances --instance-ids i-xxx
aws ec2 terminate-instances --instance-ids i-xxx

# RDS Operations
aws rds describe-db-instances            # List databases
aws rds create-db-snapshot               # Create snapshot
aws rds restore-db-instance-from-db-snapshot

# IAM Management
aws iam list-users                       # List users
aws iam list-roles                       # List roles
aws iam get-user --user-name username    # User details

# CloudWatch Logs
aws logs describe-log-groups             # List log groups
aws logs tail /aws/lambda/function-name --follow

# Cost and Billing
aws ce get-cost-and-usage               # Get cost data
aws budgets describe-budgets            # List budgets
Enter fullscreen mode Exit fullscreen mode

Additional Resources:

Have you dealt with AWS credential security in your organization? What solutions have you found effective? What's your favorite AWS CLI workflow? Share your experiences in the comments below.

And if you found this guide helpful, consider sharing it with your team. Secure development practices benefit everyone.

Top comments (0)