AWS CLI v2 · aws-cli/2.34.17 · 437 services · 3073 index entries

Written for someone who has used a command line and an AWS console and wants the structure of the tool rather than a list of tricks. The AWS CLI generates its commands from the service models it ships, so the first card explains that grammar and shows the whole surface; the second is every global option; then the custom families — configure, s3, sso, login — with every switch in a table, the config-file keys and environment variables, and the mechanisms: output and --query, input formats and shorthand, pagination and waiters, retries and endpoints. A recipes card, then authentication last: the provider chain in order, roles, MFA, SSO and how to find out which identity a command really used. Cards 1–13 are the guide; the rest is a filterable index of 3073 entries: 19 global options, the custom switches, 55 config keys, 35 environment variables, all 447 top-level commands, and 2271 subcommands of the 25 main services with their required and optional parameters in the tooltip. Press / to jump to the filter box.

Dots: read (describe / get / list) write (create / put / update / start) destructive (delete / terminate / detach) custom command, not a one-to-one API call
Sources: `aws help`, `aws help config-vars` and the per-command help of aws-cli/2.34.17, and the botocore service models bundled in that binary, harvested by a script on 28 September 2026. Hover a clipped row for the whole entry.

The Working Guide

The grammar and the whole surface first, then every switch of the custom families, the config keys, the mechanisms, and authentication last

The Whole CLI on One Card

aws-cli/2.34.17 · 437 services · 18,534 operations

The AWS CLI is one binary that generates its commands from the service models it ships: 437 service directories under botocore/data, 18,534 operations between them, each turned into aws <service> <operation-in-kebab-case> --Parameter-In-Kebab-Case. Everything else — configure, s3, sso, login, history, ddb, deploy helpers — is a handful of hand-written custom command families layered on top. Knowing that one fact means you can predict any command from its API name and read any API reference as CLI documentation.

aws [global options] <command> <subcommand> [parameters]the grammar; global options go anywhere aws ec2 describe-instances --instance-ids i-0abcEC2 DescribeInstances, InstanceIds → kebab, list as repeated values aws s3api put-object --bucket b --key k --body ./fthe one-to-one S3 API aws s3 sync ./site s3://b --deletethe custom, rsync-like layer over the same API aws ec2 describe-instances helpevery command documents itself; aws help topics lists the guides

What is in the box

LayerWhat
Service commands437 generated families (ec2 alone has 756 subcommands). The index below lists all 447 families, and every subcommand with its required and optional parameters for the 25 most-used.
Custom familiesconfigservice, configure, ddb, deploy, history, login, logout, s3api — not API calls; documented on the next cards.
Global options19 switches accepted by every command: profile, region, output, query, endpoint, retries, paging, prompt.
Configuration~/.aws/config (profiles, settings, roles, SSO) and ~/.aws/credentials (keys), plus environment variables; precedence is command line > environment > files.
Helpaws help, aws <svc> help, aws <svc> <cmd> help, aws help topics, aws help config-vars, aws help s3-config. Output goes through a pager; AWS_PAGER="" or --no-cli-pager stops that.

Install & verify

macOS
brew install awscli # or the .pkg from AWS aws --version # aws-cli/2.x Python/3.x Darwin/... exe/arm64 aws sts get-caller-identity
Linux
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip unzip awscliv2.zip && sudo ./aws/install aws --version
Windows — PowerShell
winget install -e --id Amazon.AWSCLI aws --version
Read this sheet top-down. Card 2 is every global option; cards 3–6 are the custom families with every switch; cards 7–8 are the config-file keys and environment variables; then the mechanisms; authentication is the last card. The index lists every command and, for the main services, every subcommand with its parameters in the tooltip.

Global Options

every command · 19 switches

These are accepted by every command, before or after the subcommand. Each has a config-file or environment equivalent (next cards); the command line always wins.

OptionTypeDoes
--debugbooleanTurn on debug logging.
--endpoint-urlstringOverride command's default URL with the given URL.
--no-verify-sslbooleanBy default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.
--no-paginatebooleanDisable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.
--outputstringThe formatting style for command output. * json * text * table * yaml * yaml-stream * off
--querystringA JMESPath query to use in filtering the response data.
--profilestringUse a specific profile from your credential file.
--regionstringThe region to use. Overrides config/env settings.
--versionstringDisplay the version of this tool.
--colorstringTurn on/off color output. * on * off * auto
--no-sign-requestbooleanDo not sign requests. Credentials will not be loaded if this argument is provided.
--ca-bundlestringThe CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.
--cli-read-timeoutintThe maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 sec- onds.
--cli-connect-timeoutintThe maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.
--cli-binary-formatstringThe formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When pro- viding contents from a file that map to a binary blob fileb:// will always be treated as binary and use th
--no-cli-pagerbooleanDisable cli pager for output.
--cli-auto-promptbooleanAutomatically prompt for CLI input parameters.
--no-cli-auto-promptbooleanDisable automatically prompt for CLI input parameters.
--cli-error-formatstringThe formatting style for error output. By default, errors are displayed in enhanced format. * legacy * json * yaml * text * table * enhanced
--output text --query 'Reservations[].Instances[].[InstanceId,State.Name]'the two you use daily, together --no-cli-pageror export AWS_PAGER="" once and forget it --cli-binary-format raw-in-base64-outlets fileb:// and inline payloads be plain bytes (v2 defaults to base64) --no-sign-requestanonymous calls: public S3 buckets, no credentials needed --debug 2>debug.logthe request, the signature, the credential provider that won — the answer to “which key is it using?”

aws configure

profiles · settings · SSO setup · 10 subcommands

aws configure with no subcommand is the four-question wizard (key id, secret, region, output) that writes [default] or --profile X. The subcommands read and write the same two files without the wizard.

SubSynopsisDoes
add-modeladd-model --service-model <value>Adds a service JSON model to the appropriate location in ~/.aws/models. Once the model gets added, CLI commands and Boto3 clients will be immedi- ately available for the service JSON model provided.
export-credentialsaws configure export-credentials --profile profile-nameExport credentials in various formats. This command will retrieve AWS cre- dentials using the AWS CLI's credential resolution process and display the credentials in the specified --format. By default, the output format is process, which is a JSON format that's expected by the credential process feat
getaws configure get varnameGet a configuration value from the config file.
importimport --csv <value>Import CSV credentials generated from the AWS web console. Entries in the CSV will be imported as profiles in the AWS credentials file, with the pro- file name matching the IAM User Name.
listaws configure listLists the profile, access key, secret key, and region configuration infor- mation used for the specified profile. For each configuration item, it shows the value, where the configuration value was retrieved, and the con- figuration variable name.
list-profileslist-profilesList the profiles available to the AWS CLI.
mfa-loginaws configure mfa-loginThis command gets temporary AWS security credentials for use with the AWS CLI and SDK, and places them in an AWS profile. It will use a long-lived IAM user access key, and the MFA code from either a virtual TOTP MFA de- vice, or a hardware OTP authenticator to call STS get-session-token to get the t
setaws configure set varname valueSet a configuration value from the config file.
ssoaws configure ssoThe aws configure sso command interactively prompts for the configuration values required to create a profile that sources temporary AWS credentials from AWS IAM Identity Center.
sso-sessionaws configure sso-sessionThe aws configure sso-session command interactively prompts for the config- uration values required to create a SSO session. The SSO session can then be associated to a profile to retrieve SSO access tokens and AWS creden- tials.

set / get address any key

aws configure set region us-east-2 --profile workwrites region under [profile work] aws configure set s3.max_concurrent_requests 20dotted path = nested key aws configure set aws_access_key_id AKIA… --profile workcredentials go to ~/.aws/credentials, not config aws configure get regionprints one value; exit 1 if unset — scriptable aws configure listwhere every effective value came from (env, config-file, …) aws configure export-credentials --format envresolve the whole provider chain and print it for another tool
SwitchTypeDoes
--formatstringThe output format to display credentials. Defaults to process.

import reads a CSV downloaded from the IAM console; add-model registers a service model JSON so the CLI grows a command family for an API it does not know yet; mfa-login (newer builds) trades an MFA code for cached session credentials.

aws s3 — the high-level commands

9 subcommands · 138 switches

s3 is a file-manager vocabulary (cp mv rm ls sync mb rb presign website) written over the s3api calls: it walks directories, parallelises, does multipart uploads and retries on its own. s3api is the raw API, one call per command, and is what you use for anything the high-level layer does not expose (versioning, lifecycle, bucket policy, headers on a single object).

SubSynopsisDoes
cpcp <LocalPath> <S3Uri> or <S3Uri> <LocalPath> or <S3Uri> <S3Uri>Copies a local file or S3 object to another location locally or in S3.
lsls <S3Uri> or NONEList S3 objects and common prefixes under a prefix or all S3 buckets. Note that the --output and --no-paginate arguments are ignored for this command.
mbmb <S3Uri>Creates an S3 bucket.
mvmv <LocalPath> <S3Uri> or <S3Uri> <LocalPath> or <S3Uri> <S3Uri>Moves a local file or S3 object to another location locally or in S3. The mv command copies the source object or file to the specified destination and then deletes the source object or file.
presignpresign <S3Uri>Generate a pre-signed URL for an Amazon S3 object. This allows anyone who receives the pre-signed URL to retrieve the S3 object with an HTTP GET re- quest. All presigned URL's now use sigv4 so the region needs to be config- ured explicitly.
rbrb <S3Uri>Deletes an empty S3 bucket. A bucket must be completely empty of objects and versioned objects before it can be deleted. However, the --force para- meter can be used to delete the non-versioned objects in the bucket before the bucket is deleted.
rmrm <S3Uri>Deletes an S3 object.
syncsync <LocalPath> <S3Uri> or <S3Uri> <LocalPath> or <S3Uri> <S3Uri>Syncs directories and S3 prefixes. Recursively copies new and updated files from the source directory to the destination. Only creates folders in the destination if they contain one or more files.
websitewebsite <S3Uri>Set the website configuration for a bucket.

cp / mv / sync / rm share one option set

SwitchTypeDoes
--dryrunbooleanDisplays the operations that would be performed using the specified command without actually running them.
--quietbooleanDoes not display the operations performed from the speci- fied command.
--includestringDon't exclude files or objects in the command that match the specified pattern. See Use of Exclude and Include Filters for details.
--excludestringExclude all files or objects from the command that matches the specified pattern.
--aclstringSets the ACL for the object when the command is performed. If you use this parameter you must have the "s3:PutObjectAcl" permission included in the list of actions for your IAM policy. Only accepts va
--ssestringSpecifies server-side encryption of the object in S3. Valid values are AES256 and aws:kms. If the parameter is specified but no value is provided, AES256 is used.
--sse-kms-key-idstringThe customer-managed AWS Key Management Service (KMS) key ID that should be used to server-side encrypt the object in S3. You should only provide this parameter if you are using a customer managed cus
--storage-classstringThe type of storage to use for the object. Valid choices are: STANDARD | REDUCED_REDUNDANCY | STANDARD_IA | ONEZONE_IA | IN- TELLIGENT_TIERING | GLACIER | DEEP_ARCHIVE | GLACIER_IR. Defaults to 'STAN-
--content-typestringSpecify an explicit content type for this opera- tion. This value overrides any guessed mime types.
--cache-controlstringSpecifies caching behavior along the request/reply chain.
--source-regionstringWhen transferring objects from an s3 bucket to an s3 bucket, this specifies the region of the source bucket. Note the region specified by --region or through configuration of the CLI refers to the re-
--only-show-errorsbooleanOnly errors and warnings are displayed. All other output is suppressed.
--no-progressbooleanFile transfer progress is not displayed. This flag is only applied when the quiet and only-show-errors flags are not provided.
--page-sizeintegerThe number of results to return in each response to a list operation. The default value is 1000 (the maximum allowed). Using a lower value may help if an operation times out.
--request-payerstringConfirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. Documentation on downloading objects from requester pays b
--checksum-modestringTo retrieve the checksum, this mode must be en- abled. If the object has a checksum, it will be verified.
--checksum-algorithmstringIndicates the algorithm used to create the checksum for the object.
--metadatamapA map of metadata to store with the objects in S3. This will be applied to every object which is part of this request. In a sync, this means that files which haven't changed won't receive the new meta
--copy-propsstringDetermines which properties are copied from the source S3 object. This parameter only applies for S3 to S3 copies. Valid values are:
--metadata-directivestringSets the x-amz-metadata-directive header for CopyObject operations. It is recommended to use the --copy-props parameter instead to control copying of metadata properties. If --metadata-directive is se
--case-conflictstringConfigures behavior when attempting to download multiple objects whose keys differ only by case, which can cause undefined behavior on case-insensitive filesystems. This parameter only applies for com
--no-overwritebooleanThis flag prevents overwriting of files at the destination. With this flag, only files not present at the destination will be transferred.
--size-onlybooleanMakes the size of each key the only criteria used to decide whether to sync from source to destination.
--exact-timestampsbooleanWhen syncing from S3 to local, same-sized items will be ignored only when the timestamps match exactly. The default behavior is to ignore same-sized items unless the local version is newer than the S3
--deletebooleanFiles that exist in the destination but not in the source are deleted during sync. Note that files excluded by filters are ex- cluded from deletion.

ls

SwitchTypeDoes
--recursivebooleanCommand is performed on all files or objects under the specified directory or prefix.
--page-sizeintegerThe number of results to return in each response to a list operation. The default value is 1000 (the maximum allowed). Using a lower value may help if an operation times out.
--human-readablebooleanDisplays file sizes in human readable format.
--summarizebooleanDisplays summary information (number of objects, to- tal size).
--request-payerstringConfirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. Documentation on downloading objects from requester pays b
--bucket-name-prefixstringLimits the response to bucket names that be- gin with the specified bucket name prefix.
--bucket-regionstringLimits the response to buckets that are located in the specified Amazon Web Services Region. The Amazon Web Services Region must be expressed according to the Amazon Web Services Region code, such as

presign · mb · rb · website

SwitchTypeDoes
--expires-inintegerNumber of seconds until the pre-signed URL expires. Default is 3600 seconds. Maximum is 604800 seconds.
SwitchTypeDoes
--forcebooleanDeletes all objects in the bucket including the bucket itself. Note that versioned objects will not be deleted in this process which would cause the bucket deletion to fail because the bucket would no
SwitchTypeDoes
--index-documentstringA suffix that is appended to a request that is for a directory on the website endpoint (e.g. if the suffix is index.html and you make a request to samplebucket/images/ the data that is returned will b
--error-documentstringThe object key name to use when a 4XX class error occurs.
--include / --exclude are applied in order and the default is include-everything, so --exclude "*" --include "*.html" is the pattern; --include "*.html" alone does nothing. --delete on sync removes destination files missing from the source — the same trap as rsync --delete: never point it at a docroot that carries server-side backups.
aws s3 sync ./site s3://bucket --exclude ".*" --delete --dryrunsee what a deploy would do before it does it aws s3 cp - s3://b/k --content-type text/plain < file- is stdin/stdout on cp aws s3 presign s3://b/k --expires-in 3600a shareable URL, signed with the current credentials aws s3 ls s3://b --recursive --human-readable --summarizewhere the bytes are

aws sso · aws login · the other custom families

Identity Center · console login · history · ddb · deploy

sso — IAM Identity Center

SubSynopsisDoes
get-role-credentialsget-role-credentials --role-name <value> --account-id <value> --access-token <value>Returns the STS short-term credentials for a given role name that is as- signed to the user.
list-account-roleslist-account-roles --access-token <value> --account-id <value>Lists all roles that are assigned to the user for a given AWS account.
list-accountslist-accounts --access-token <value>Lists all AWS accounts assigned to the user. These AWS accounts are as- signed by the administrator of the account. For more information, see Assign User Access in the IAM Identity Center User Guide . This operation returns a paginated response.
loginloginRetrieves and caches an AWS IAM Identity Center access token to exchange for AWS credentials. To login, the requested profile must have first been setup using aws configure sso. Each time the login command is called, a new SSO access token will be retrieved. Please note that only one login session c
logoutlogoutRemoves all cached AWS IAM Identity Center access tokens and any cached temporary AWS credentials retrieved with SSO access tokens across all pro- files. To use these profiles again, run: aws sso login
SwitchTypeDoes
--no-browserbooleanDisables automatically opening the verification URL in the default browser.
--use-device-codebooleanUses the Device Code authorization grant and login flow instead of the Authorization Code flow.
--sso-sessionstringAn explicit SSO session to use to login. By default, this command will login using the SSO session configured as part of the re- quested profile and generally does not require this argument to be set.

The flow: aws configure sso writes an [sso-session] block and a profile that points at it; aws sso login --profile X (or --sso-session name) opens the browser once, and the CLI then mints short-lived role credentials from the cached token on every call until it expires. logout deletes the cache. The list-accounts / list-account-roles / get-role-credentials subcommands are the underlying API and are what the flow calls internally.

login — console-session credentials

aws loginsign in with Management Console credentials in the browser; the CLI caches temporary credentials and a refresh token it renews itself aws logoutclear that cache for the profile AWS_LOGIN_CACHE_DIRECTORYwhere the cache lives

history

aws configure set cli_history enabledstart recording (off by default) aws history listevery recorded invocation with its id aws history show <id>the request, response and credential provider of one call — the audit trail for “what did that script do?”

ddb

aws ddb put table '{"pk":"1","v":"x"}'shorthand DynamoDB writes aws ddb select table --key-condition 'pk = 1' --projection vquery without the JSON expression ceremony

deploy

CodeDeploy’s API plus three helpers: push bundles a directory into a revision in S3, register / deregister manage on-premises instances, install / uninstall the agent. Everything else is the generated API.

The Config & Credentials Files

~/.aws/config · ~/.aws/credentials

Two INI files. credentials holds only keys and is read first; config holds everything else and can also hold keys (not recommended). Profiles are [default] and [profile name] in config but [name] without the word profile in credentials — the mismatch that makes a profile “not found” when it plainly is there.

# ~/.aws/config [default] region = us-east-1 output = json cli_pager = [profile work] region = us-east-2 role_arn = arn:aws:iam::123456789012:role/Admin source_profile = default mfa_serial = arn:aws:iam::123456789012:mfa/george [profile lab] sso_session = corp sso_account_id = 123456789012 sso_role_name = PowerUser [sso-session corp] sso_start_url = https://d-…awsapps.com/start sso_region = us-east-1 sso_registration_scopes = sso:account:access [services local] s3 = endpoint_url = http://localhost:9000 # ~/.aws/credentials [default] aws_access_key_id = AKIA… aws_secret_access_key = …

Every key

KeyMeaning
regiondefault region for every call; --region and AWS_REGION win over it
outputjson | text | table | yaml | yaml-stream | off
cli_pagerpager program; empty disables paging
cli_timestamp_formatwire | iso8601 — how timestamps are printed
cli_auto_prompton | on-partial | off — the interactive prompt
cli_binary_formatbase64 | raw-in-base64-out — how blob parameters are read
cli_historyenabled records every command for aws history
cli_error_formathow errors print
ca_bundleCA bundle path for TLS verification
parameter_validationfalse skips client-side parameter validation
tcp_keepaliveTCP keep-alive on the connection
max_attemptstotal attempts, first try included
retry_modelegacy | standard | adaptive
endpoint_urlendpoint override for every service in the profile
servicesname of a [services X] section holding per-service endpoint_url entries
ignore_configured_endpoint_urlstrue ignores every endpoint_url from config and environment
use_fips_endpointtrue prefers FIPS endpoints
use_dualstack_endpointtrue prefers dual-stack endpoints
sts_regional_endpointsregional | legacy
defaults_modestandard | in-region | cross-region | mobile | auto | legacy — a tuned bundle of timeouts and retries
request_checksum_calculationwhen_supported | when_required
response_checksum_validationwhen_supported | when_required
account_id_endpoint_modepreferred | disabled | required — account-based endpoints
sdk_ua_app_idapp id for the User-Agent header
api_versionsnested: pin a service to an older API version
s3nested block: max_concurrent_requests, max_queue_size, multipart_threshold, multipart_chunksize, max_bandwidth, use_accelerate_endpoint, addressing_style, payload_signing_enabled, us_east_1_regional_endpoint
aws_access_key_idstatic credential (better in the credentials file)
aws_secret_access_keystatic credential (better in the credentials file)
aws_session_tokensession token for temporary static credentials
credential_processexternal command that prints credentials as JSON
sso_sessionname of a [sso-session X] section (token provider)
sso_start_urlIAM Identity Center portal URL (in the sso-session section)
sso_regionregion of the Identity Center instance
sso_account_idaccount the profile signs into
sso_role_namepermission set to assume
sso_registration_scopesOIDC scopes requested at registration, e.g. sso:account:access

Nested blocks (s3 =, api_versions =) are indented lines under the key. A profile named on the command line but missing from both files is an error; an unset key falls back to the environment, then to the CLI default. aws configure list shows the winner and its source.

Environment Variables

read after the command line, before the files

Every environment variable maps to a config key or a global option. They are the way CI systems and containers pass credentials, and the way to pin a region for one process (AWS_REGION=us-east-2 aws …) without touching the files.

VariableMeaning
AWS_ACCESS_KEY_IDaccess key; with AWS_SECRET_ACCESS_KEY overrides every file
AWS_SECRET_ACCESS_KEYsecret half of the key pair
AWS_SESSION_TOKENsession token for temporary credentials
AWS_PROFILEprofile to use; wins over the config default, loses to --profile
AWS_DEFAULT_PROFILEolder name still honoured for the same thing
AWS_REGIONregion; wins over AWS_DEFAULT_REGION and the config file
AWS_DEFAULT_REGIONlegacy region variable, read when AWS_REGION is unset
AWS_DEFAULT_OUTPUTjson | text | table | yaml | yaml-stream
AWS_CONFIG_FILEpath of the config file (default ~/.aws/config)
AWS_SHARED_CREDENTIALS_FILEpath of the credentials file (default ~/.aws/credentials)
AWS_CA_BUNDLECA certificate bundle for TLS verification
AWS_PAGERpager for output; empty string disables paging (the same as --no-cli-pager)
AWS_CLI_AUTO_PROMPTon | on-partial | off
AWS_CLI_FILE_ENCODINGencoding used when reading file:// parameters
AWS_MAX_ATTEMPTStotal attempts including the first (retry)
AWS_RETRY_MODElegacy | standard | adaptive
AWS_ROLE_ARNrole to assume with web identity
AWS_ROLE_SESSION_NAMEsession name for that assumed role
AWS_WEB_IDENTITY_TOKEN_FILEpath to the OIDC token used by AssumeRoleWithWebIdentity
AWS_EC2_METADATA_DISABLEDtrue stops the CLI probing the instance metadata service
AWS_METADATA_SERVICE_TIMEOUTseconds to wait for IMDS (default 1)
AWS_METADATA_SERVICE_NUM_ATTEMPTSIMDS attempts (default 1)
AWS_ENDPOINT_URLendpoint override for every service
AWS_ENDPOINT_URL_<SERVICE>per-service override, e.g. AWS_ENDPOINT_URL_S3
AWS_IGNORE_CONFIGURED_ENDPOINT_URLStrue ignores endpoint_url settings from config and env
AWS_USE_FIPS_ENDPOINTtrue routes to FIPS endpoints where they exist
AWS_USE_DUALSTACK_ENDPOINTtrue routes to IPv4/IPv6 dual-stack endpoints
AWS_STS_REGIONAL_ENDPOINTSregional | legacy — which STS endpoint to sign against
AWS_DATA_PATHextra directories searched for service models (aws configure add-model)
AWS_SDK_UA_APP_IDapp id added to the User-Agent header
AWS_REQUEST_CHECKSUM_CALCULATIONwhen_supported | when_required (S3 checksums on upload)
AWS_RESPONSE_CHECKSUM_VALIDATIONwhen_supported | when_required
AWS_ACCOUNT_IDaccount id used to build account-based endpoints
AWS_BEARER_TOKEN_BEDROCKbearer token used instead of SigV4 for Bedrock (API keys)
AWS_LOGIN_CACHE_DIRECTORYwhere aws login keeps its cached credentials
AWS_ACCESS_KEY_ID in the environment silently shadows every profile. --profile work still applies the profile’s region and settings, but the credentials come from the environment. When a command acts as the wrong identity, env | grep AWS_ before anything else.

Output & --query

json · text · table · yaml · JMESPath

--output

jsonthe default; what --query operates on texttab-separated, one line per leaf list item — for $( ) and read in shell tableboxed ASCII; for humans yamlwhole document yaml-streamone YAML doc per page as pages arrive — the only streaming output offnothing on stdout; exit status only

--query is JMESPath over the JSON response

ExpressionSelects
Reservations[].Instances[]flatten two levels of lists
Instances[?State.Name=='running']filter — single quotes inside the expression, so double-quote the whole thing in bash
[?contains(Tags[?Key=='Name'].Value, 'web')]filter on a tag
[].{id:InstanceId, ip:PublicIpAddress, name:Tags[?Key=='Name']|[0].Value}multiselect hash — rename columns
[].[InstanceId, State.Name]multiselect list — positional columns for text output
sort_by(Instances, &LaunchTime)[-1]newest; & marks an expression argument
length(Buckets) max_by(…) to_string(…) join(', ', …)functions
Volumes[?!Attachments] [?starts_with(Name, 'x')]negation, string predicates
Account · Buckets[0].Name · Buckets[*].Namea scalar, one item, a projection
aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId,State.Name,Tags[?Key=='Name']|[0].Value]" --output tablethe inventory one-liner IP=$(aws ec2 describe-instances --instance-ids $ID --query 'Reservations[0].Instances[0].PublicIpAddress' --output text)a value into a variable; None when absent, so test for it aws ce get-cost-and-usage … --query 'ResultsByTime[].Groups[].[Keys[0],Metrics.UnblendedCost.Amount]' --output textbill by line into a spreadsheet

--query runs client-side on the full response; it does not save the call, and on paginated commands it is applied after all pages are merged. --color on keeps colour when piping to less -R.

Input — parameters, shorthand, JSON, files

kebab-case · shorthand · --cli-input-json · file://

Every API parameter becomes --kebab-case. Scalars take a value; lists take repeated values (--instance-ids a b c); structures take either shorthand or JSON; blobs take fileb://. The whole request can come from one JSON document instead.

Shorthand syntax

--tags Key=Name,Value=web Key=Env,Value=prodlist of structures: space-separated items, k=v,k=v inside --block-device-mappings DeviceName=/dev/sda1,Ebs={VolumeSize=50,VolumeType=gp3}nested structure in braces --filters Name=tag:Name,Values=web,apia list inside a structure: comma-separated, no spaces --dimensions Name=InstanceId,Value=i-0abcone structure; repeat the option for more

JSON and files

--cli-input-json file://req.jsonthe entire request body; other options may not repeat its keys --cli-input-yaml file://req.yamlsame, YAML --generate-cli-skeleton input > req.jsona template with every parameter, to fill in --generate-cli-skeleton outputthe shape of the response, for writing --query blind --user-data file://boot.shtext file contents as the value --body fileb://image.pngbinary; with --cli-binary-format raw-in-base64-out for blob parameters --policy-document '{"Version":"2012-10-17",…}'inline JSON: single-quote it in bash, escape it in PowerShell
Timestamps are accepted as ISO 8601, epoch seconds, or 2026-09-28T12:00:00Z; printed per cli_timestamp_format. Booleans are flags: --dry-run / --no-dry-run; a value after them is an error. Enums are validated client-side unless parameter_validation = false.

Pagination, Filters & Waiters

--max-items · --starting-token · wait

Pagination is automatic

List and describe commands fetch every page and merge them before printing. Three options control it, and they are client-side, distinct from the service’s own --max-results.

--page-size 100items per API call (a tuning knob, not a limit on output) --max-items 50stop after this many items; prints NextToken if there were more --starting-token <NextToken>resume from where the last --max-items stopped --no-paginateone call only; you handle the service token yourself

Filters are service-side, and every service spells them differently

aws ec2 describe-instances --filters Name=instance-state-name,Values=runningEC2: Name/Values pairs aws logs filter-log-events --log-group-name g --filter-pattern '"ERROR"'Logs: a pattern language aws ce get-cost-and-usage --filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon Bedrock"]}}'Cost Explorer: a JSON expression aws iam list-users --query "Users[?starts_with(UserName,'a')]"no filter at all — use --query

Waiters

aws ec2 wait instance-running --instance-ids $IDpoll until the state is reached; exit 255 on timeout aws ec2 wait helpthe list of waiters a service has (instance-stopped, volume-available, …) aws cloudformation wait stack-create-complete --stack-name severy long-running service has them

Retries, Timeouts, Endpoints & the Prompt

retry_mode · --endpoint-url · --cli-auto-prompt

Retries

retry_mode = standardthe sane default: exponential backoff with jitter, a token bucket retry_mode = adaptivestandard plus client-side rate limiting on throttling errors retry_mode = legacyv1 behaviour; only for reproducing old scripts max_attempts = 5counts the first try; AWS_MAX_ATTEMPTS in the environment

Timeouts

--cli-connect-timeout 60seconds to open the socket (0 = wait forever) --cli-read-timeout 60seconds to wait for bytes on an open socket

Endpoints

--endpoint-url http://localhost:4566LocalStack, MinIO, a VPC endpoint — every call in this invocation AWS_ENDPOINT_URL_S3=…one service; or a [services] block in config --no-verify-ssl / --ca-bundleself-signed endpoints use_fips_endpoint / use_dualstack_endpointalternate public endpoints where they exist sts_regional_endpoints = regionalsign STS calls against the region, not the global endpoint

The interactive prompt

aws --cli-auto-promptfull-screen completion of commands, parameters and values, with the docs beside them cli_auto_prompt = on-partialprompt only when a command is incomplete or wrong — scripts unaffected --no-cli-auto-promptforce it off for one call
Exit codes: 0 success · 1 the service refused (error printed) · 2 the CLI could not parse the command · 130 Ctrl-C · 252 a parameter failed validation · 253 the config or credentials were unusable · 254 unhandled service error · 255 general failure. Scripts branch on these, never on stderr text.

Everyday Recipes

the calls that answer a question
aws sts get-caller-identitywho am I — the first command after any auth change aws configure listand where those credentials came from aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId,State.Name,PublicIpAddress,Tags[?Key=='Name']|[0].Value]" --output tablethe fleet aws ec2 start-instances --instance-ids $ID && aws ec2 wait instance-running --instance-ids $IDstart and wait aws ssm start-session --target $IDa shell with no open port 22 (needs the session-manager plugin) aws logs tail /aws/lambda/fn --follow --since 10mlive logs aws s3 sync ./site s3://bucket --exclude ".*" --dryrunwhat a deploy would change aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICEthe bill by service (lags a day) aws budgets describe-budgets --account-id $(aws sts get-caller-identity --query Account --output text)the alarms on that bill aws route53 list-resource-record-sets --hosted-zone-id Z… --query "ResourceRecordSets[?Type=='A']"DNS as it really is aws iam get-access-key-last-used --access-key-id AKIA…is this key alive? aws bedrock-runtime converse --model-id global.anthropic.claude-sonnet-4-6 --messages '[{"role":"user","content":[{"text":"hi"}]}]' --query 'output.message.content[0].text' --output textone model call from the shell aws bedrock get-foundation-model-availability --model-id anthropic.claude-sonnet-5why a model says “not available for this account” aws secretsmanager get-secret-value --secret-id name --query SecretString --output texta secret into a pipe, never into a file

Authentication

the credential chain · SSO · roles · MFA · process

Every request is signed with SigV4 using whatever credentials the provider chain finds first. The CLI tries these sources in order and stops at the first that yields a key:

#SourceWhere it comes from
1Command line--profile selects; there is no option for a raw key
2EnvironmentAWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY (+ AWS_SESSION_TOKEN)
3Assume rolea profile with role_arn: credentials from source_profile or credential_source are used to call STS
4Web identityweb_identity_token_file / AWS_WEB_IDENTITY_TOKEN_FILE — Kubernetes, GitHub OIDC
5IAM Identity Centera profile with sso_session; the cached token from aws sso login
6Credentials file~/.aws/credentials [profile]
7Config filekeys written into ~/.aws/config
8Credential processcredential_process = a command printing {"Version":1,"AccessKeyId":…}
9ContainerAWS_CONTAINER_CREDENTIALS_RELATIVE_URI (ECS task role)
10Instance metadataIMDSv2 on EC2 — the instance profile role; disable with AWS_EC2_METADATA_DISABLED

Assume a role, with or without MFA

[profile admin] role_arn = arn:aws:iam::123456789012:role/Admin source_profile = default mfa_serial = arn:aws:iam::123456789012:mfa/george duration_seconds = 3600 role_session_name = george-cli external_id = … # only when the trust policy demands one

The CLI prompts for the MFA code and caches the session credentials under ~/.aws/cli/cache until they expire. credential_source = Environment | Ec2InstanceMetadata | EcsContainer replaces source_profile when the base credentials are not in a file.

IAM Identity Center (SSO) — the recommended human login

aws configure ssowrites the sso-session and profile blocks interactively aws sso login --profile labbrowser once; short-lived role credentials afterwards, renewed from the cached token aws sso logoutforget the token

Other doors

aws loginconsole-session credentials with a refresh token (newest builds) aws configure export-credentials --format envhand the resolved credentials to a tool that cannot read the chain aws sts get-session-token --serial-number … --token-code 123456manual MFA session for a static key aws sts assume-role --role-arn … --role-session-name smanual role; export the three values it prints AWS_BEARER_TOKEN_BEDROCK=…Bedrock API keys: a bearer token instead of SigV4, for that one service --no-sign-requestno credentials at all — public buckets
Diagnosing the wrong identity. In order: aws sts get-caller-identity (who), aws configure list (which source won), env | grep AWS_ (a stray key in the environment beats every profile), then --debug and search the log for Found credentials. A profile that is in config as [profile x] but in credentials as [profile x] (with the word) is the classic “profile not found”.
Hygiene. Long-lived access keys are the last resort: prefer SSO for people and roles for machines, rotate what remains (aws iam list-access-keys, get-access-key-last-used), never put a key on a command line where shell history keeps it, and give scripts --profile explicitly so they cannot inherit a stray environment.

Option, Setting, Service & Command Index

Every global option, every configure / s3 / sso switch, every config key and environment variable, all 447 top-level commands, and every subcommand of the 25 main services with its parameters — read out of the CLI’s own help and service models. Type in the filter box, or press /

Global options

19

Accepted by every command, after aws or at the end

--debugboolean Turn on debug logging.
--endpoint-urlstring Override command's default URL with the given URL.
--no-verify-sslboolean By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.
--no-paginateboolean Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.
--outputstring The formatting style for command output. * json * text * table * yaml * yaml-stream * off
--querystring A JMESPath query to use in filtering the response data.
--profilestring Use a specific profile from your credential file.
--regionstring The region to use. Overrides config/env settings.
--versionstring Display the version of this tool.
--colorstring Turn on/off color output. * on * off * auto
--no-sign-requestboolean Do not sign requests. Credentials will not be loaded if this argument is provided.
--ca-bundlestring The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.
--cli-read-timeoutint The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 sec- onds.
--cli-connect-timeoutint The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.
--cli-binary-formatstring The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When pro- viding contents from a file that map to a binary blob fileb:// will always be treated as binary and use th
--no-cli-pagerboolean Disable cli pager for output.
--cli-auto-promptboolean Automatically prompt for CLI input parameters.
--no-cli-auto-promptboolean Disable automatically prompt for CLI input parameters.
--cli-error-formatstring The formatting style for error output. By default, errors are displayed in enhanced format. * legacy * json * yaml * text * table * enhanced

aws configure

21

Subcommands

aws configure add-modelAdds a service JSON model to the appropriate location in ~/.aws/models. Once the model gets added, CLI commands and Boto3 clients will be immedi- ately available for the service JSON model provided.
aws configure export-credentialsExport credentials in various formats. This command will retrieve AWS cre- dentials using the AWS CLI's credential resolution process and display the credentials in the specified --format. By default, the output format is process, which is a JSON format that's expected by the credential process feat
aws configure getGet a configuration value from the config file.
aws configure importImport CSV credentials generated from the AWS web console. Entries in the CSV will be imported as profiles in the AWS credentials file, with the pro- file name matching the IAM User Name.
aws configure listLists the profile, access key, secret key, and region configuration infor- mation used for the specified profile. For each configuration item, it shows the value, where the configuration value was retrieved, and the con- figuration variable name.
aws configure list-profilesList the profiles available to the AWS CLI.
aws configure mfa-loginThis command gets temporary AWS security credentials for use with the AWS CLI and SDK, and places them in an AWS profile. It will use a long-lived IAM user access key, and the MFA code from either a virtual TOTP MFA de- vice, or a hardware OTP authenticator to call STS get-session-token to get the t
aws configure setSet a configuration value from the config file.
aws configure ssoThe aws configure sso command interactively prompts for the configuration values required to create a profile that sources temporary AWS credentials from AWS IAM Identity Center.
aws configure sso-sessionThe aws configure sso-session command interactively prompts for the config- uration values required to create a SSO session. The SSO session can then be associated to a profile to retrieve SSO access tokens and AWS creden- tials.

aws configure add-model options

--service-modelstring [required] The contents of the service JSON model.
--service-namestring Overrides the default name used by the service JSON model to generate CLI service commands and Boto3 clients.

aws configure export-credentials options

--formatstring The output format to display credentials. Defaults to process.

aws configure import options

--csvstring [required] The credentials in CSV format generated by the AWS web console. The CSV file must contain the "User name", "Access key ID", and "Secret access key" headers.If passing a CSV file path instea
--skip-invalidboolean Skip entries that are invalid or do not have pro- grammatic access instead of failing.
--profile-prefixstring Adds the specified prefix to the beginning of all profile names.

aws configure mfa-login options

--update-profilestring The profile to update with temporary credentials. If not provided, a default name will be generated.
--duration-secondsinteger The duration, in seconds, that the credentials should remain valid. Minimum is 900 seconds (15 minutes), maximum is 129600 seconds (36 hours).
--serial-numberstring The ARN or serial number of the MFA device associ- ated with the IAM user. If not provided, will use the mfa_serial from the profile configuration.

aws configure sso options

--no-browserboolean Disables automatically opening the verification URL in the default browser.
--use-device-codeboolean Uses the Device Code authorization grant and login flow instead of the Authorization Code flow.

aws sso · aws login

25

Subcommands

aws sso get-role-credentialsReturns the STS short-term credentials for a given role name that is as- signed to the user.
aws sso list-account-rolesLists all roles that are assigned to the user for a given AWS account.
aws sso list-accountsLists all AWS accounts assigned to the user. These AWS accounts are as- signed by the administrator of the account. For more information, see Assign User Access in the IAM Identity Center User Guide . This operation returns a paginated response.
aws sso loginRetrieves and caches an AWS IAM Identity Center access token to exchange for AWS credentials. To login, the requested profile must have first been setup using aws configure sso. Each time the login command is called, a new SSO access token will be retrieved. Please note that only one login session c
aws sso logoutRemoves all cached AWS IAM Identity Center access tokens and any cached temporary AWS credentials retrieved with SSO access tokens across all pro- files. To use these profiles again, run: aws sso login

aws sso get-role-credentials options

--role-namestring [required] The friendly name of the role that is assigned to the user.
--account-idstring [required] The identifier for the AWS account that is assigned to the user.
--access-tokenstring [required] The token issued by the CreateToken API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
--generate-cli-skeletonstring Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value in- put, prints a sample input JSON that can be used as an argument for

aws sso list-account-roles options

--access-tokenstring [required] The token issued by the CreateToken API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
--account-idstring [required] The identifier for the AWS account that is assigned to the user.
--starting-tokenstring A token to specify where to start paginating. This is the NextToken from a previously truncated response.
--page-sizeinteger The size of each page to get in the AWS service call. This does not af- fect the number of items returned in the command's output. Setting a smaller page size results in more calls to the AWS service,
--max-itemsinteger The total number of items to return in the command's output. If the to- tal number of items available is more than the value specified, a Next- Token is provided in the command's output. To resume pag
--generate-cli-skeletonstring Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value in- put, prints a sample input JSON that can be used as an argument for

aws sso list-accounts options

--access-tokenstring [required] The token issued by the CreateToken API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
--starting-tokenstring A token to specify where to start paginating. This is the NextToken from a previously truncated response.
--page-sizeinteger The size of each page to get in the AWS service call. This does not af- fect the number of items returned in the command's output. Setting a smaller page size results in more calls to the AWS service,
--max-itemsinteger The total number of items to return in the command's output. If the to- tal number of items available is more than the value specified, a Next- Token is provided in the command's output. To resume pag
--generate-cli-skeletonstring Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value in- put, prints a sample input JSON that can be used as an argument for

aws sso login options

--no-browserboolean Disables automatically opening the verification URL in the default browser.
--use-device-codeboolean Uses the Device Code authorization grant and login flow instead of the Authorization Code flow.
--sso-sessionstring An explicit SSO session to use to login. By default, this command will login using the SSO session configured as part of the re- quested profile and generally does not require this argument to be set.

Console-session login (new in 2.3x)

aws loginsign in with AWS Management Console credentials; caches temporary credentials plus a refresh token that the CLI renews on its own
aws logoutclear the cached login credentials for the profile

aws s3 (high-level)

147

Subcommands

aws s3 cpCopies a local file or S3 object to another location locally or in S3.
aws s3 lsList S3 objects and common prefixes under a prefix or all S3 buckets. Note that the --output and --no-paginate arguments are ignored for this command.
aws s3 mbCreates an S3 bucket.
aws s3 mvMoves a local file or S3 object to another location locally or in S3. The mv command copies the source object or file to the specified destination and then deletes the source object or file.
aws s3 presignGenerate a pre-signed URL for an Amazon S3 object. This allows anyone who receives the pre-signed URL to retrieve the S3 object with an HTTP GET re- quest. All presigned URL's now use sigv4 so the region needs to be config- ured explicitly.
aws s3 rbDeletes an empty S3 bucket. A bucket must be completely empty of objects and versioned objects before it can be deleted. However, the --force para- meter can be used to delete the non-versioned objects in the bucket before the bucket is deleted.
aws s3 rmDeletes an S3 object.
aws s3 syncSyncs directories and S3 prefixes. Recursively copies new and updated files from the source directory to the destination. Only creates folders in the destination if they contain one or more files.
aws s3 websiteSet the website configuration for a bucket.

aws s3 cp options

--dryrunboolean Displays the operations that would be performed using the specified command without actually running them.
--quietboolean Does not display the operations performed from the speci- fied command.
--includestring Don't exclude files or objects in the command that match the specified pattern. See Use of Exclude and Include Filters for details.
--excludestring Exclude all files or objects from the command that matches the specified pattern.
--aclstring Sets the ACL for the object when the command is performed. If you use this parameter you must have the "s3:PutObjectAcl" permission included in the list of actions for your IAM policy. Only accepts va
--no-guess-mime-typeboolean Do not try to guess the mime type for up- loaded files. By default the mime type of a file is guessed when it is up- loaded.
--ssestring Specifies server-side encryption of the object in S3. Valid values are AES256 and aws:kms. If the parameter is specified but no value is provided, AES256 is used.
--sse-cstring Specifies server-side encryption using customer provided keys of the the object in S3. AES256 is the only valid value. If the para- meter is specified but no value is provided, AES256 is used. If you
--sse-c-keyblob The customer-provided encryption key to use to server-side encrypt the object in S3. If you provide this value, --sse-c must be specified as well. The key provided should not be base64 encoded.
--sse-kms-key-idstring The customer-managed AWS Key Management Service (KMS) key ID that should be used to server-side encrypt the object in S3. You should only provide this parameter if you are using a customer managed cus
--sse-c-copy-sourcestring This parameter should only be specified when copying an S3 object that was encrypted server-side with a customer-pro- vided key. It specifies the algorithm to use when decrypting the source ob- ject.
--sse-c-copy-source-keyblob This parameter should only be specified when copying an S3 object that was encrypted server-side with a customer-pro- vided key. Specifies the customer-provided encryption key for Amazon S3 to use to
--storage-classstring The type of storage to use for the object. Valid choices are: STANDARD | REDUCED_REDUNDANCY | STANDARD_IA | ONEZONE_IA | IN- TELLIGENT_TIERING | GLACIER | DEEP_ARCHIVE | GLACIER_IR. Defaults to 'STAN-
--grantsstring Grant specific permissions to individual users or groups. You can supply a list of grants of the form
--website-redirectstring If the bucket is configured as a website, redi- rects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metad
--content-typestring Specify an explicit content type for this opera- tion. This value overrides any guessed mime types.
--cache-controlstring Specifies caching behavior along the request/reply chain.
--content-dispositionstring Specifies presentational information for the object.
--content-encodingstring Specifies what content encodings have been ap- plied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
--content-languagestring The language the content is in.
--expiresstring The date and time at which the object is no longer cacheable.
--source-regionstring When transferring objects from an s3 bucket to an s3 bucket, this specifies the region of the source bucket. Note the region specified by --region or through configuration of the CLI refers to the re-
--only-show-errorsboolean Only errors and warnings are displayed. All other output is suppressed.
--no-progressboolean File transfer progress is not displayed. This flag is only applied when the quiet and only-show-errors flags are not provided.
--progress-frequencyinteger Number of seconds to wait before updating file transfer progress. This flag is only applied when the quiet and only-show-errors flags are not provided.
--progress-multilineboolean Show progress on multiple lines.
--page-sizeinteger The number of results to return in each response to a list operation. The default value is 1000 (the maximum allowed). Using a lower value may help if an operation times out.
--ignore-glacier-warningsboolean Turns off glacier warnings. Warnings about an operation that cannot be performed because it involves copying, downloading, or moving a glacier object will no longer be printed to stan- dard error and
--force-glacier-transferboolean Forces a transfer request on all Glacier objects in a sync or recursive copy.
--request-payerstring Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. Documentation on downloading objects from requester pays b
--checksum-modestring To retrieve the checksum, this mode must be en- abled. If the object has a checksum, it will be verified.
--checksum-algorithmstring Indicates the algorithm used to create the checksum for the object.
--metadatamap A map of metadata to store with the objects in S3. This will be applied to every object which is part of this request. In a sync, this means that files which haven't changed won't receive the new meta
--copy-propsstring Determines which properties are copied from the source S3 object. This parameter only applies for S3 to S3 copies. Valid values are:
--metadata-directivestring Sets the x-amz-metadata-directive header for CopyObject operations. It is recommended to use the --copy-props parameter instead to control copying of metadata properties. If --metadata-directive is se
--expected-sizestring This argument specifies the expected size of a stream in terms of bytes. Note that this argument is needed only when a stream is being uploaded to s3 and the size is larger than 50GB. Failure to inclu
--recursiveboolean Command is performed on all files or objects under the specified directory or prefix.
--case-conflictstring Configures behavior when attempting to download multiple objects whose keys differ only by case, which can cause undefined behavior on case-insensitive filesystems. This parameter only applies for com
--no-overwriteboolean This flag prevents overwriting of files at the destination. With this flag, only files not present at the destination will be transferred.

aws s3 ls options

--recursiveboolean Command is performed on all files or objects under the specified directory or prefix.
--page-sizeinteger The number of results to return in each response to a list operation. The default value is 1000 (the maximum allowed). Using a lower value may help if an operation times out.
--human-readableboolean Displays file sizes in human readable format.
--summarizeboolean Displays summary information (number of objects, to- tal size).
--request-payerstring Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. Documentation on downloading objects from requester pays b
--bucket-name-prefixstring Limits the response to bucket names that be- gin with the specified bucket name prefix.
--bucket-regionstring Limits the response to buckets that are located in the specified Amazon Web Services Region. The Amazon Web Services Region must be expressed according to the Amazon Web Services Region code, such as

aws s3 mb options

--tagsstring This flag specifies tags to be added to the bucket in the format of --tags key value. You can specify this flag multiple times, once for each tag.

aws s3 mv options

--dryrunboolean Displays the operations that would be performed using the specified command without actually running them.
--quietboolean Does not display the operations performed from the speci- fied command.
--includestring Don't exclude files or objects in the command that match the specified pattern. See Use of Exclude and Include Filters for details.
--excludestring Exclude all files or objects from the command that matches the specified pattern.
--aclstring Sets the ACL for the object when the command is performed. If you use this parameter you must have the "s3:PutObjectAcl" permission included in the list of actions for your IAM policy. Only accepts va
--no-guess-mime-typeboolean Do not try to guess the mime type for up- loaded files. By default the mime type of a file is guessed when it is up- loaded.
--ssestring Specifies server-side encryption of the object in S3. Valid values are AES256 and aws:kms. If the parameter is specified but no value is provided, AES256 is used.
--sse-cstring Specifies server-side encryption using customer provided keys of the the object in S3. AES256 is the only valid value. If the para- meter is specified but no value is provided, AES256 is used. If you
--sse-c-keyblob The customer-provided encryption key to use to server-side encrypt the object in S3. If you provide this value, --sse-c must be specified as well. The key provided should not be base64 encoded.
--sse-kms-key-idstring The customer-managed AWS Key Management Service (KMS) key ID that should be used to server-side encrypt the object in S3. You should only provide this parameter if you are using a customer managed cus
--sse-c-copy-sourcestring This parameter should only be specified when copying an S3 object that was encrypted server-side with a customer-pro- vided key. It specifies the algorithm to use when decrypting the source ob- ject.
--sse-c-copy-source-keyblob This parameter should only be specified when copying an S3 object that was encrypted server-side with a customer-pro- vided key. Specifies the customer-provided encryption key for Amazon S3 to use to
--storage-classstring The type of storage to use for the object. Valid choices are: STANDARD | REDUCED_REDUNDANCY | STANDARD_IA | ONEZONE_IA | IN- TELLIGENT_TIERING | GLACIER | DEEP_ARCHIVE | GLACIER_IR. Defaults to 'STAN-
--grantsstring Grant specific permissions to individual users or groups. You can supply a list of grants of the form
--website-redirectstring If the bucket is configured as a website, redi- rects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metad
--content-typestring Specify an explicit content type for this opera- tion. This value overrides any guessed mime types.
--cache-controlstring Specifies caching behavior along the request/reply chain.
--content-dispositionstring Specifies presentational information for the object.
--content-encodingstring Specifies what content encodings have been ap- plied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
--content-languagestring The language the content is in.
--expiresstring The date and time at which the object is no longer cacheable.
--source-regionstring When transferring objects from an s3 bucket to an s3 bucket, this specifies the region of the source bucket. Note the region specified by --region or through configuration of the CLI refers to the re-
--only-show-errorsboolean Only errors and warnings are displayed. All other output is suppressed.
--no-progressboolean File transfer progress is not displayed. This flag is only applied when the quiet and only-show-errors flags are not provided.
--progress-frequencyinteger Number of seconds to wait before updating file transfer progress. This flag is only applied when the quiet and only-show-errors flags are not provided.
--progress-multilineboolean Show progress on multiple lines.
--page-sizeinteger The number of results to return in each response to a list operation. The default value is 1000 (the maximum allowed). Using a lower value may help if an operation times out.
--ignore-glacier-warningsboolean Turns off glacier warnings. Warnings about an operation that cannot be performed because it involves copying, downloading, or moving a glacier object will no longer be printed to stan- dard error and
--force-glacier-transferboolean Forces a transfer request on all Glacier objects in a sync or recursive copy.
--request-payerstring Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. Documentation on downloading objects from requester pays b
--checksum-modestring To retrieve the checksum, this mode must be en- abled. If the object has a checksum, it will be verified.
--checksum-algorithmstring Indicates the algorithm used to create the checksum for the object.
--metadatamap A map of metadata to store with the objects in S3. This will be applied to every object which is part of this request. In a sync, this means that files which haven't changed won't receive the new meta
--copy-propsstring Determines which properties are copied from the source S3 object. This parameter only applies for S3 to S3 copies. Valid values are:
--metadata-directivestring Sets the x-amz-metadata-directive header for CopyObject operations. It is recommended to use the --copy-props parameter instead to control copying of metadata properties. If --metadata-directive is se
--recursiveboolean Command is performed on all files or objects under the specified directory or prefix.
--validate-same-s3-pathsboolean Resolves the source and destination S3 URIs to their underlying buckets and verifies that the file or object is not being moved onto itself. If you are using any type of access point ARNs or access po
--case-conflictstring Configures behavior when attempting to download multiple objects whose keys differ only by case, which can cause undefined behavior on case-insensitive filesystems. This parameter only applies for com
--no-overwriteboolean This flag prevents overwriting of files at the destination. With this flag, only files not present at the destination will be transferred.

aws s3 presign options

--expires-ininteger Number of seconds until the pre-signed URL expires. Default is 3600 seconds. Maximum is 604800 seconds.

aws s3 rb options

--forceboolean Deletes all objects in the bucket including the bucket itself. Note that versioned objects will not be deleted in this process which would cause the bucket deletion to fail because the bucket would no

aws s3 rm options

--dryrunboolean Displays the operations that would be performed using the specified command without actually running them.
--quietboolean Does not display the operations performed from the speci- fied command.
--recursiveboolean Command is performed on all files or objects under the specified directory or prefix.
--request-payerstring Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. Documentation on downloading objects from requester pays b
--includestring Don't exclude files or objects in the command that match the specified pattern. See Use of Exclude and Include Filters for details.
--excludestring Exclude all files or objects from the command that matches the specified pattern.
--only-show-errorsboolean Only errors and warnings are displayed. All other output is suppressed.
--page-sizeinteger The number of results to return in each response to a list operation. The default value is 1000 (the maximum allowed). Using a lower value may help if an operation times out.

aws s3 sync options

--dryrunboolean Displays the operations that would be performed using the specified command without actually running them.
--quietboolean Does not display the operations performed from the speci- fied command.
--includestring Don't exclude files or objects in the command that match the specified pattern. See Use of Exclude and Include Filters for details.
--excludestring Exclude all files or objects from the command that matches the specified pattern.
--aclstring Sets the ACL for the object when the command is performed. If you use this parameter you must have the "s3:PutObjectAcl" permission included in the list of actions for your IAM policy. Only accepts va
--no-guess-mime-typeboolean Do not try to guess the mime type for up- loaded files. By default the mime type of a file is guessed when it is up- loaded.
--ssestring Specifies server-side encryption of the object in S3. Valid values are AES256 and aws:kms. If the parameter is specified but no value is provided, AES256 is used.
--sse-cstring Specifies server-side encryption using customer provided keys of the the object in S3. AES256 is the only valid value. If the para- meter is specified but no value is provided, AES256 is used. If you
--sse-c-keyblob The customer-provided encryption key to use to server-side encrypt the object in S3. If you provide this value, --sse-c must be specified as well. The key provided should not be base64 encoded.
--sse-kms-key-idstring The customer-managed AWS Key Management Service (KMS) key ID that should be used to server-side encrypt the object in S3. You should only provide this parameter if you are using a customer managed cus
--sse-c-copy-sourcestring This parameter should only be specified when copying an S3 object that was encrypted server-side with a customer-pro- vided key. It specifies the algorithm to use when decrypting the source ob- ject.
--sse-c-copy-source-keyblob This parameter should only be specified when copying an S3 object that was encrypted server-side with a customer-pro- vided key. Specifies the customer-provided encryption key for Amazon S3 to use to
--storage-classstring The type of storage to use for the object. Valid choices are: STANDARD | REDUCED_REDUNDANCY | STANDARD_IA | ONEZONE_IA | IN- TELLIGENT_TIERING | GLACIER | DEEP_ARCHIVE | GLACIER_IR. Defaults to 'STAN-
--grantsstring Grant specific permissions to individual users or groups. You can supply a list of grants of the form
--website-redirectstring If the bucket is configured as a website, redi- rects requests for this object to another object in the same bucket or to an external URL. Amazon S3 stores the value of this header in the object metad
--content-typestring Specify an explicit content type for this opera- tion. This value overrides any guessed mime types.
--cache-controlstring Specifies caching behavior along the request/reply chain.
--content-dispositionstring Specifies presentational information for the object.
--content-encodingstring Specifies what content encodings have been ap- plied to the object and thus what decoding mechanisms must be applied to obtain the media-type referenced by the Content-Type header field.
--content-languagestring The language the content is in.
--expiresstring The date and time at which the object is no longer cacheable.
--source-regionstring When transferring objects from an s3 bucket to an s3 bucket, this specifies the region of the source bucket. Note the region specified by --region or through configuration of the CLI refers to the re-
--only-show-errorsboolean Only errors and warnings are displayed. All other output is suppressed.
--no-progressboolean File transfer progress is not displayed. This flag is only applied when the quiet and only-show-errors flags are not provided.
--progress-frequencyinteger Number of seconds to wait before updating file transfer progress. This flag is only applied when the quiet and only-show-errors flags are not provided.
--progress-multilineboolean Show progress on multiple lines.
--page-sizeinteger The number of results to return in each response to a list operation. The default value is 1000 (the maximum allowed). Using a lower value may help if an operation times out.
--ignore-glacier-warningsboolean Turns off glacier warnings. Warnings about an operation that cannot be performed because it involves copying, downloading, or moving a glacier object will no longer be printed to stan- dard error and
--force-glacier-transferboolean Forces a transfer request on all Glacier objects in a sync or recursive copy.
--request-payerstring Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. Documentation on downloading objects from requester pays b
--checksum-modestring To retrieve the checksum, this mode must be en- abled. If the object has a checksum, it will be verified.
--checksum-algorithmstring Indicates the algorithm used to create the checksum for the object.
--metadatamap A map of metadata to store with the objects in S3. This will be applied to every object which is part of this request. In a sync, this means that files which haven't changed won't receive the new meta
--copy-propsstring Determines which properties are copied from the source S3 object. This parameter only applies for S3 to S3 copies. Valid values are:
--metadata-directivestring Sets the x-amz-metadata-directive header for CopyObject operations. It is recommended to use the --copy-props parameter instead to control copying of metadata properties. If --metadata-directive is se
--case-conflictstring Configures behavior when attempting to download multiple objects whose keys differ only by case, which can cause undefined behavior on case-insensitive filesystems. This parameter only applies for com
--no-overwriteboolean This flag prevents overwriting of files at the destination. With this flag, only files not present at the destination will be transferred.
--size-onlyboolean Makes the size of each key the only criteria used to decide whether to sync from source to destination.
--exact-timestampsboolean When syncing from S3 to local, same-sized items will be ignored only when the timestamps match exactly. The default behavior is to ignore same-sized items unless the local version is newer than the S3
--deleteboolean Files that exist in the destination but not in the source are deleted during sync. Note that files excluded by filters are ex- cluded from deletion.

aws s3 website options

--index-documentstring A suffix that is appended to a request that is for a directory on the website endpoint (e.g. if the suffix is index.html and you make a request to samplebucket/images/ the data that is returned will b
--error-documentstring The object key name to use when a 4XX class error occurs.

Other custom families

53

aws history

aws history list—
aws history show—

aws ddb

aws ddb put—
aws ddb select—

aws deploy (CodeDeploy, with push/register helpers)

aws deploy add-tags-to-on-premises-instances—
aws deploy batch-get-application-revisions—
aws deploy batch-get-applications—
aws deploy batch-get-deployment-groups—
aws deploy batch-get-deployment-targets—
aws deploy batch-get-deployments—
aws deploy batch-get-on-premises-instances—
aws deploy continue-deployment—
aws deploy create-application—
aws deploy create-deployment—
aws deploy create-deployment-config—
aws deploy create-deployment-group—
aws deploy delete-application—
aws deploy delete-deployment-config—
aws deploy delete-deployment-group—
aws deploy delete-git-hub-account-token—
aws deploy delete-resources-by-external-id—
aws deploy deregister—
aws deploy deregister-on-premises-instance—
aws deploy get-application—
aws deploy get-application-revision—
aws deploy get-deployment—
aws deploy get-deployment-config—
aws deploy get-deployment-group—
aws deploy get-deployment-target—
aws deploy get-on-premises-instance—
aws deploy install—
aws deploy list-application-revisions—
aws deploy list-applications—
aws deploy list-deployment-configs—
aws deploy list-deployment-groups—
aws deploy list-deployment-targets—
aws deploy list-deployments—
aws deploy list-git-hub-account-token-names—
aws deploy list-on-premises-instances—
aws deploy list-tags-for-resource—
aws deploy push—
aws deploy put-lifecycle-event-hook-execution-status—
aws deploy register—
aws deploy register-application-revision—
aws deploy register-on-premises-instance—
aws deploy remove-tags-from-on-premises-instances—
aws deploy stop-deployment—
aws deploy tag-resource—
aws deploy uninstall—
aws deploy untag-resource—
aws deploy update-application—
aws deploy update-deployment-group—
aws deploy wait—

Config file settings

55

~/.aws/config keys — general, endpoints, S3, SSO

regiondefault region for every call; --region and AWS_REGION win over it
outputjson | text | table | yaml | yaml-stream | off
cli_pagerpager program; empty disables paging
cli_timestamp_formatwire | iso8601 &mdash; how timestamps are printed
cli_auto_prompton | on-partial | off &mdash; the interactive prompt
cli_binary_formatbase64 | raw-in-base64-out &mdash; how blob parameters are read
cli_historyenabled records every command for aws history
cli_error_formathow errors print
ca_bundleCA bundle path for TLS verification
parameter_validationfalse skips client-side parameter validation
tcp_keepaliveTCP keep-alive on the connection
max_attemptstotal attempts, first try included
retry_modelegacy | standard | adaptive
endpoint_urlendpoint override for every service in the profile
servicesname of a [services X] section holding per-service endpoint_url entries
ignore_configured_endpoint_urlstrue ignores every endpoint_url from config and environment
use_fips_endpointtrue prefers FIPS endpoints
use_dualstack_endpointtrue prefers dual-stack endpoints
sts_regional_endpointsregional | legacy
defaults_modestandard | in-region | cross-region | mobile | auto | legacy &mdash; a tuned bundle of timeouts and retries
request_checksum_calculationwhen_supported | when_required
response_checksum_validationwhen_supported | when_required
account_id_endpoint_modepreferred | disabled | required &mdash; account-based endpoints
sdk_ua_app_idapp id for the User-Agent header
api_versionsnested: pin a service to an older API version
s3nested block: max_concurrent_requests, max_queue_size, multipart_threshold, multipart_chunksize, max_bandwidth, use_accelerate_endpoint, addressing_style, payload_signing_enabled, us_east_1_regional_endpoint
aws_access_key_idstatic credential (better in the credentials file)
aws_secret_access_keystatic credential (better in the credentials file)
aws_session_tokensession token for temporary static credentials
credential_processexternal command that prints credentials as JSON
sso_sessionname of a [sso-session X] section (token provider)
sso_start_urlIAM Identity Center portal URL (in the sso-session section)
sso_regionregion of the Identity Center instance
sso_account_idaccount the profile signs into
sso_role_namepermission set to assume
sso_registration_scopesOIDC scopes requested at registration, e.g. sso:account:access

Assume-role and web-identity keys, as aws help config-vars describes them

enhancedErrors display additional fields in a human-readable format with inline display for simple values and small collections. This is the default behavior.
jsonErrors are formatted as JSON, showing all available fields.
yamlErrors are formatted as YAML, showing all available fields.
textErrors are formatted as text with key-value pairs, showing all available fields.
tableErrors are formatted as a table, showing all available fields.
legacyErrors are written to stderr as unstructured text, displaying only the error code and message without additional fields.
wireDisplay the timestamp exactly as received from the HTTP response.
role_arnThe ARN of the role you want to assume.
source_profileThe AWS CLI profile that contains credentials / configu- ration the CLI should use for the initial assume-role call. This profile may be another profile configured to use assume-role, though if static credentials are pre
credential_sourceThe credential provider to use to get credentials for the initial assume-role call. This parameter cannot be provided alongside source_profile. Valid values are:
external_idA unique identifier that is used by third parties to assume a role in their customers' accounts. This maps to the ExternalId parame- ter in the AssumeRole operation. This is an optional parameter.
mfa_serialThe identification number of the MFA device to use when as- suming a role. This is an optional parameter. Specify this value if the trust policy of the role being assumed includes a condition that requires MFA authentica
role_session_nameThe name applied to this assume-role session. This value affects the assumed role user ARN (such as arn:aws:sts::123456789012:assumed-role/role_name/role_session_name). This maps to the RoleSessionName parameter in the A
duration_secondsThe duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. This is an optional parameter and by default, the value is set to
role_arnThe ARN of the role you want to assume.
web_identity_token_fileThe path to a file which contains an OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity provider. The contents of this file will be loaded and passed as the We- bIdentityToken argument to
role_session_nameThe name applied to this assume-role session. This value affects the assumed role user ARN (such as arn:aws:sts::123456789012:assumed-role/role_name/role_session_name). This maps to the RoleSessionName parameter in the A
standardA standardized set of retry rules across the AWS SDKs. This includes a standard set of errors that are retried as well as support for retry quotas, which limit the number of unsuccessful retries an SDK can make. This mod
adaptiveAn experimental retry mode that includes all the functionality of standard mode along with automatic client side throttling. This is a provisional mode that may change behav- ior in the future.

Environment variables

35

Read before the config file, after the command line

AWS_ACCESS_KEY_IDaccess key; with AWS_SECRET_ACCESS_KEY overrides every file
AWS_SECRET_ACCESS_KEYsecret half of the key pair
AWS_SESSION_TOKENsession token for temporary credentials
AWS_PROFILEprofile to use; wins over the config default, loses to --profile
AWS_DEFAULT_PROFILEolder name still honoured for the same thing
AWS_REGIONregion; wins over AWS_DEFAULT_REGION and the config file
AWS_DEFAULT_REGIONlegacy region variable, read when AWS_REGION is unset
AWS_DEFAULT_OUTPUTjson | text | table | yaml | yaml-stream
AWS_CONFIG_FILEpath of the config file (default ~/.aws/config)
AWS_SHARED_CREDENTIALS_FILEpath of the credentials file (default ~/.aws/credentials)
AWS_CA_BUNDLECA certificate bundle for TLS verification
AWS_PAGERpager for output; empty string disables paging (the same as --no-cli-pager)
AWS_CLI_AUTO_PROMPTon | on-partial | off
AWS_CLI_FILE_ENCODINGencoding used when reading file:// parameters
AWS_MAX_ATTEMPTStotal attempts including the first (retry)
AWS_RETRY_MODElegacy | standard | adaptive
AWS_ROLE_ARNrole to assume with web identity
AWS_ROLE_SESSION_NAMEsession name for that assumed role
AWS_WEB_IDENTITY_TOKEN_FILEpath to the OIDC token used by AssumeRoleWithWebIdentity
AWS_EC2_METADATA_DISABLEDtrue stops the CLI probing the instance metadata service
AWS_METADATA_SERVICE_TIMEOUTseconds to wait for IMDS (default 1)
AWS_METADATA_SERVICE_NUM_ATTEMPTSIMDS attempts (default 1)
AWS_ENDPOINT_URLendpoint override for every service
AWS_ENDPOINT_URL_<SERVICE>per-service override, e.g. AWS_ENDPOINT_URL_S3
AWS_IGNORE_CONFIGURED_ENDPOINT_URLStrue ignores endpoint_url settings from config and env
AWS_USE_FIPS_ENDPOINTtrue routes to FIPS endpoints where they exist
AWS_USE_DUALSTACK_ENDPOINTtrue routes to IPv4/IPv6 dual-stack endpoints
AWS_STS_REGIONAL_ENDPOINTSregional | legacy &mdash; which STS endpoint to sign against
AWS_DATA_PATHextra directories searched for service models (aws configure add-model)
AWS_SDK_UA_APP_IDapp id added to the User-Agent header
AWS_REQUEST_CHECKSUM_CALCULATIONwhen_supported | when_required (S3 checksums on upload)
AWS_RESPONSE_CHECKSUM_VALIDATIONwhen_supported | when_required
AWS_ACCOUNT_IDaccount id used to build account-based endpoints
AWS_BEARER_TOKEN_BEDROCKbearer token used instead of SigV4 for Bedrock (API keys)
AWS_LOGIN_CACHE_DIRECTORYwhere aws login keeps its cached credentials

All 447 commands

447

Every first word after aws, with its service and how many subcommands it has

accessanalyzerAccess Analyzer · 37 commands · api 2019-11-01
accountAWS Account · 15 commands · api 2021-02-01
acmAWS Certificate Manager · 16 commands · api 2015-12-08
acm-pcaAWS Certificate Manager Private Certificate Authority · 23 commands · api 2017-08-22
aiopsAWS AI Ops · 11 commands · api 2018-05-10
alexaforbusinessAlexa For Business · 93 commands · api 2017-11-09
ampAmazon Prometheus Service · 44 commands · api 2020-08-01
amplifyAWS Amplify · 37 commands · api 2017-07-25
amplifybackendAmplifyBackend · 31 commands · api 2020-08-11
amplifyuibuilderAWS Amplify UI Builder · 28 commands · api 2021-08-11
apigatewayAmazon API Gateway · 124 commands · api 2015-07-09
apigatewaymanagementapiAmazonApiGatewayManagementApi · 3 commands · api 2018-11-29
apigatewayv2AmazonApiGatewayV2 · 103 commands · api 2018-11-29
appconfigAmazon AppConfig · 45 commands · api 2019-10-09
appconfigdataAWS AppConfig Data · 2 commands · api 2021-11-11
appfabricAppFabric · 26 commands · api 2023-05-19
appflowAmazon Appflow · 25 commands · api 2020-08-23
appintegrationsAmazon AppIntegrations Service · 23 commands · api 2020-07-29
application-autoscalingApplication Auto Scaling · 14 commands · api 2016-02-06
application-insightsAmazon CloudWatch Application Insights · 33 commands · api 2018-11-25
application-signalsAmazon CloudWatch Application Signals · 23 commands · api 2024-04-15
applicationcostprofilerAWS Application Cost Profiler · 6 commands · api 2020-09-10
appmeshAWS App Mesh · 38 commands · api 2019-01-25
apprunnerAWS App Runner · 37 commands · api 2020-05-15
appstreamAmazon AppStream · 88 commands · api 2016-12-01
appsyncAWS AppSync · 74 commands · api 2017-07-25
arc-region-switchARC - Region switch · 21 commands · api 2022-07-26
arc-zonal-shiftAWS ARC - Zonal Shift · 15 commands · api 2022-10-30
artifactAWS Artifact · 8 commands · api 2018-05-10
athenaAmazon Athena · 70 commands · api 2017-05-18
auditmanagerAWS Audit Manager · 62 commands · api 2017-07-25
autoscalingAuto Scaling · 66 commands · api 2011-01-01
autoscaling-plansAWS Auto Scaling Plans · 6 commands · api 2018-01-06
b2biAWS B2B Data Interchange · 30 commands · api 2022-06-23
backupAWS Backup · 108 commands · api 2018-11-15
backup-gatewayAWS Backup Gateway · 25 commands · api 2021-01-01
backupsearchAWS Backup Search · 12 commands · api 2018-05-10
batchAWS Batch · 45 commands · api 2016-08-10
bcm-dashboardsAWS Billing and Cost Management Dashboards · 9 commands · api 2025-08-18
bcm-data-exportsAWS Billing and Cost Management Data Exports · 12 commands · api 2023-11-26
bcm-pricing-calculatorAWS Billing and Cost Management Pricing Calculator · 36 commands · api 2024-06-19
bcm-recommended-actionsAWS Billing and Cost Management Recommended Actions · 1 commands · api 2024-11-14
bedrockAmazon Bedrock · 98 commands · api 2023-04-20
bedrock-agentAgents for Amazon Bedrock · 72 commands · api 2023-06-05
bedrock-agent-runtimeAgents for Amazon Bedrock Runtime · 31 commands · api 2023-07-26
bedrock-agentcoreAmazon Bedrock AgentCore · 37 commands · api 2024-02-28
bedrock-agentcore-controlAmazon Bedrock AgentCore Control · 86 commands · api 2023-06-05
bedrock-data-automationData Automation for Amazon Bedrock · 17 commands · api 2023-07-26
bedrock-data-automation-runtimeRuntime for Amazon Bedrock Data Automation · 6 commands · api 2024-06-13
bedrock-runtimeAmazon Bedrock Runtime · 10 commands · api 2023-09-30
billingAWS Billing · 12 commands · api 2023-09-07
billingconductorAWSBillingConductor · 32 commands · api 2021-07-30
braketBraket · 17 commands · api 2019-09-01
budgetsAWS Budgets · 26 commands · api 2016-10-20
ceAWS Cost Explorer Service · 47 commands · api 2017-10-25
chatbotAWS Chatbot · 34 commands · api 2017-10-11
chimeAmazon Chime · 62 commands · api 2018-05-01
chime-sdk-identityAmazon Chime SDK Identity · 30 commands · api 2021-04-20
chime-sdk-media-pipelinesAmazon Chime SDK Media Pipelines · 31 commands · api 2021-07-15
chime-sdk-meetingsAmazon Chime SDK Meetings · 16 commands · api 2021-07-15
chime-sdk-messagingAmazon Chime SDK Messaging · 51 commands · api 2021-05-15
chime-sdk-voiceAmazon Chime SDK Voice · 96 commands · api 2022-08-03
cleanroomsAWS Clean Rooms Service · 88 commands · api 2022-02-17
cleanroomsmlAWS Clean Rooms ML · 59 commands · api 2023-09-06
cli-devcustom command family (not a service model)
cloud9AWS Cloud9 · 13 commands · api 2017-09-23
cloudcontrolAWS Cloud Control API · 8 commands · api 2021-09-30
clouddirectoryAmazon CloudDirectory · 66 commands · api 2017-01-11
cloudformationAWS CloudFormation · 90 commands · api 2010-05-15
cloudfrontAmazon CloudFront · 167 commands · api 2020-05-31
cloudfront-keyvaluestoreAmazon CloudFront KeyValueStore · 6 commands · api 2022-07-26
cloudhsmAmazon CloudHSM · 20 commands · api 2014-05-30
cloudhsmv2AWS CloudHSM V2 · 18 commands · api 2017-04-28
cloudsearchAmazon CloudSearch · 26 commands · api 2013-01-01
cloudsearchdomainAmazon CloudSearch Domain · 3 commands · api 2013-01-01
cloudtrailAWS CloudTrail · 60 commands · api 2013-11-01
cloudtrail-dataAWS CloudTrail Data Service · 1 commands · api 2021-08-11
cloudwatchAmazon CloudWatch · 43 commands · api 2010-08-01
codeartifactCodeArtifact · 48 commands · api 2018-09-22
codebuildAWS CodeBuild · 59 commands · api 2016-10-06
codecatalystAmazon CodeCatalyst · 38 commands · api 2022-09-28
codecommitAWS CodeCommit · 79 commands · api 2015-04-13
codeconnectionsAWS CodeConnections · 27 commands · api 2023-12-01
codeguru-reviewerAmazon CodeGuru Reviewer · 14 commands · api 2019-09-19
codeguru-securityAmazon CodeGuru Security · 13 commands · api 2018-05-10
codeguruprofilerAmazon CodeGuru Profiler · 23 commands · api 2019-07-18
codepipelineAWS CodePipeline · 44 commands · api 2015-07-09
codestarAWS CodeStar · 18 commands · api 2017-04-19
codestar-connectionsAWS CodeStar connections · 27 commands · api 2019-12-01
codestar-notificationsAWS CodeStar Notifications · 13 commands · api 2019-10-15
cognito-identityAmazon Cognito Identity · 23 commands · api 2014-06-30
cognito-idpAmazon Cognito Identity Provider · 122 commands · api 2016-04-18
cognito-syncAmazon Cognito Sync · 17 commands · api 2014-06-30
comprehendAmazon Comprehend · 85 commands · api 2017-11-27
comprehendmedicalAWS Comprehend Medical · 26 commands · api 2018-10-30
compute-optimizerAWS Compute Optimizer · 28 commands · api 2019-11-01
compute-optimizer-automationCompute Optimizer Automation · 23 commands · api 2025-09-22
configservicecustom command family (not a service model)
configurecustom command family (not a service model)
connectAmazon Connect Service · 367 commands · api 2017-08-08
connect-contact-lensAmazon Connect Contact Lens · 1 commands · api 2020-08-21
connectcampaignsAmazonConnectCampaignService · 22 commands · api 2021-01-30
connectcampaignsv2AmazonConnectCampaignServiceV2 · 35 commands · api 2024-04-23
connectcasesAmazon Connect Cases · 43 commands · api 2022-10-03
connecthealthConnect Health · 16 commands · api 2025-01-29
connectparticipantAmazon Connect Participant Service · 11 commands · api 2018-09-07
controlcatalogAWS Control Catalog · 6 commands · api 2018-05-10
controltowerAWS Control Tower · 28 commands · api 2018-05-10
cost-optimization-hubCost Optimization Hub · 8 commands · api 2022-07-26
curAWS Cost and Usage Report Service · 7 commands · api 2017-01-06
customer-profilesAmazon Connect Customer Profiles · 102 commands · api 2020-08-15
databrewAWS Glue DataBrew · 44 commands · api 2017-07-25
dataexchangeAWS Data Exchange · 37 commands · api 2017-07-25
datapipelineAWS Data Pipeline · 19 commands · api 2012-10-29
datasyncAWS DataSync · 53 commands · api 2018-11-09
datazoneAmazon DataZone · 176 commands · api 2018-05-10
daxAmazon DynamoDB Accelerator (DAX) · 21 commands · api 2017-04-19
ddbcustom command family (not a service model)
deadlineAWSDeadlineCloud · 113 commands · api 2023-10-12
deploycustom command family (not a service model)
detectiveAmazon Detective · 29 commands · api 2018-10-26
devicefarmAWS Device Farm · 77 commands · api 2015-06-23
devops-guruAmazon DevOps Guru · 31 commands · api 2020-12-01
directconnectAWS Direct Connect · 63 commands · api 2012-10-25
discoveryAWS Application Discovery Service · 28 commands · api 2015-11-01
dlmAmazon Data Lifecycle Manager · 8 commands · api 2018-01-12
dmsAWS Database Migration Service · 119 commands · api 2016-01-01
docdbAmazon DocumentDB with MongoDB compatibility · 55 commands · api 2014-10-31
docdb-elasticAmazon DocumentDB Elastic Clusters · 19 commands · api 2022-11-28
drsElastic Disaster Recovery Service · 50 commands · api 2020-02-26
dsAWS Directory Service · 80 commands · api 2015-04-16
ds-dataAWS Directory Service Data · 17 commands · api 2023-05-31
dsqlAmazon Aurora DSQL · 12 commands · api 2018-05-10
dynamodbAmazon DynamoDB · 57 commands · api 2012-08-10
dynamodbstreamsAmazon DynamoDB Streams · 4 commands · api 2012-08-10
ebsAmazon Elastic Block Store · 6 commands · api 2019-11-02
ec2Amazon Elastic Compute Cloud · 756 commands · api 2016-11-15
ec2-instance-connectAWS EC2 Instance Connect · 2 commands · api 2018-04-02
ecrAmazon Elastic Container Registry · 58 commands · api 2015-09-21
ecr-publicAmazon Elastic Container Registry Public · 23 commands · api 2020-10-30
ecsAmazon EC2 Container Service · 64 commands · api 2014-11-13
efsAmazon Elastic File System · 31 commands · api 2015-02-01
eksAmazon Elastic Kubernetes Service · 64 commands · api 2017-11-01
eks-authAmazon EKS Auth · 1 commands · api 2023-11-26
elastic-inferenceAmazon Elastic Inference · 6 commands · api 2017-07-25
elasticacheAmazon ElastiCache · 75 commands · api 2015-02-02
elasticbeanstalkAWS Elastic Beanstalk · 47 commands · api 2010-12-01
elastictranscoderAmazon Elastic Transcoder · 17 commands · api 2012-09-25
elbElastic Load Balancing · 29 commands · api 2012-06-01
elbv2Elastic Load Balancing · 51 commands · api 2015-12-01
elementalinferenceAWS Elemental Inference · 10 commands · api 2018-11-14
emrAmazon EMR · 60 commands · api 2009-03-31
emr-containersAmazon EMR Containers · 23 commands · api 2020-10-01
emr-serverlessEMR Serverless · 16 commands · api 2021-07-13
entityresolutionAWS EntityResolution · 38 commands · api 2018-05-10
esAmazon Elasticsearch Service · 51 commands · api 2015-01-01
eventsAmazon EventBridge · 57 commands · api 2015-10-07
evidentlyAmazon CloudWatch Evidently · 32 commands · api 2021-02-01
evsAmazon Elastic VMware Service · 14 commands · api 2023-07-27
finspaceFinSpace User Environment Management service · 50 commands · api 2021-03-12
finspace-dataFinSpace Public API · 31 commands · api 2020-07-13
firehoseAmazon Kinesis Firehose · 12 commands · api 2015-08-04
fisAWS Fault Injection Simulator · 26 commands · api 2020-12-01
fmsFirewall Management Service · 42 commands · api 2018-01-01
forecastAmazon Forecast Service · 63 commands · api 2018-06-26
forecastqueryAmazon Forecast Query Service · 2 commands · api 2018-06-26
frauddetectorAmazon Fraud Detector · 73 commands · api 2019-11-15
freetierAWS Free Tier · 5 commands · api 2023-09-07
fsxAmazon FSx · 48 commands · api 2018-03-01
gameliftAmazon GameLift · 119 commands · api 2015-10-01
gameliftstreamsAmazon GameLift Streams · 24 commands · api 2018-05-10
geo-mapsAmazon Location Service Maps V2 · 5 commands · api 2020-11-19
geo-placesAmazon Location Service Places V2 · 7 commands · api 2020-11-19
geo-routesAmazon Location Service Routes V2 · 5 commands · api 2020-11-19
glacierAmazon Glacier · 33 commands · api 2012-06-01
globalacceleratorAWS Global Accelerator · 56 commands · api 2018-08-08
glueAWS Glue · 265 commands · api 2017-03-31
grafanaAmazon Managed Grafana · 25 commands · api 2020-08-18
greengrassAWS Greengrass · 92 commands · api 2017-06-07
greengrassv2AWS IoT Greengrass V2 · 29 commands · api 2020-11-30
groundstationAWS Ground Station · 35 commands · api 2019-05-23
guarddutyAmazon GuardDuty · 87 commands · api 2017-11-28
healthAWS Health APIs and Notifications · 14 commands · api 2016-08-04
healthlakeAmazon HealthLake · 13 commands · api 2017-07-01
helpcustom command family (not a service model)
historycustom command family (not a service model)
honeycodeAmazon Honeycode · 12 commands · api 2020-03-01
iamAWS Identity and Access Management · 176 commands · api 2010-05-08
identitystoreAWS SSO Identity Store · 19 commands · api 2020-06-15
imagebuilderEC2 Image Builder · 77 commands · api 2019-12-02
importexportAWS Import/Export · 6 commands · api 2010-06-01
inspectorAmazon Inspector · 37 commands · api 2016-02-16
inspector-scanInspector Scan · 1 commands · api 2023-08-08
inspector2Inspector2 · 75 commands · api 2020-06-08
internetmonitorAmazon CloudWatch Internet Monitor · 16 commands · api 2021-06-03
invoicingAWS Invoicing · 17 commands · api 2024-12-01
iotAWS IoT · 272 commands · api 2015-05-28
iot-dataAWS IoT Data Plane · 8 commands · api 2015-05-28
iot-jobs-dataAWS IoT Jobs Data Plane · 5 commands · api 2017-09-29
iot-managed-integrationsManaged integrations for AWS IoT Device Management · 83 commands · api 2025-03-03
iot1click-devicesAWS IoT 1-Click Devices Service · 13 commands · api 2018-05-14
iot1click-projectsAWS IoT 1-Click Projects Service · 16 commands · api 2018-05-14
iotanalyticsAWS IoT Analytics · 34 commands · api 2017-11-27
iotdeviceadvisorAWS IoT Core Device Advisor · 14 commands · api 2020-09-18
ioteventsAWS IoT Events · 26 commands · api 2018-07-27
iotevents-dataAWS IoT Events Data · 12 commands · api 2018-10-23
iotfleethubAWS IoT Fleet Hub · 8 commands · api 2020-11-03
iotfleetwiseAWS IoT FleetWise · 57 commands · api 2021-06-17
iotsecuretunnelingAWS IoT Secure Tunneling · 8 commands · api 2018-10-05
iotsitewiseAWS IoT SiteWise · 104 commands · api 2019-12-02
iotthingsgraphAWS IoT Things Graph · 35 commands · api 2018-09-06
iottwinmakerAWS IoT TwinMaker · 40 commands · api 2021-11-29
iotwirelessAWS IoT Wireless · 112 commands · api 2020-11-22
ivsAmazon Interactive Video Service · 35 commands · api 2020-07-14
ivs-realtimeAmazon Interactive Video Service RealTime · 39 commands · api 2020-07-14
ivschatAmazon Interactive Video Service Chat · 17 commands · api 2020-07-14
kafkaManaged Streaming for Kafka · 59 commands · api 2018-11-14
kafkaconnectManaged Streaming for Kafka Connect · 18 commands · api 2021-09-14
kendraAWSKendraFrontendService · 66 commands · api 2019-02-03
kendra-rankingAmazon Kendra Intelligent Ranking · 9 commands · api 2022-10-19
keyspacesAmazon Keyspaces · 19 commands · api 2022-02-10
keyspacesstreamsAmazon Keyspaces Streams · 4 commands · api 2024-09-09
kinesisAmazon Kinesis · 39 commands · api 2013-12-02
kinesis-video-archived-mediaAmazon Kinesis Video Streams Archived Media · 6 commands · api 2017-09-30
kinesis-video-mediaAmazon Kinesis Video Streams Media · 1 commands · api 2017-09-30
kinesis-video-signalingAmazon Kinesis Video Signaling Channels · 2 commands · api 2019-12-04
kinesis-video-webrtc-storageAmazon Kinesis Video WebRTC Storage · 2 commands · api 2018-05-10
kinesisanalyticsAmazon Kinesis Analytics · 20 commands · api 2015-08-14
kinesisanalyticsv2Amazon Kinesis Analytics · 33 commands · api 2018-05-23
kinesisvideoAmazon Kinesis Video Streams · 32 commands · api 2017-09-30
kmsAWS Key Management Service · 53 commands · api 2014-11-01
lakeformationAWS Lake Formation · 61 commands · api 2017-03-31
lambdaAWS Lambda · 85 commands · api 2015-03-31
launch-wizardAWS Launch Wizard · 15 commands · api 2018-05-10
lex-modelsAmazon Lex Model Building Service · 42 commands · api 2017-04-19
lex-runtimeAmazon Lex Runtime Service · 5 commands · api 2016-11-28
lexv2-modelsAmazon Lex Model Building V2 · 107 commands · api 2020-08-07
lexv2-runtimeAmazon Lex Runtime V2 · 6 commands · api 2020-08-07
license-managerAWS License Manager · 62 commands · api 2018-08-01
license-manager-linux-subscriptionsAWS License Manager Linux Subscriptions · 11 commands · api 2018-05-10
license-manager-user-subscriptionsAWS License Manager User Subscriptions · 17 commands · api 2018-05-10
lightsailAmazon Lightsail · 161 commands · api 2016-11-28
locationAmazon Location Service · 60 commands · api 2020-11-19
logincustom command family (not a service model)
logoutcustom command family (not a service model)
logsAmazon CloudWatch Logs · 108 commands · api 2014-03-28
lookoutequipmentAmazon Lookout for Equipment · 49 commands · api 2020-12-15
lookoutmetricsAmazon Lookout for Metrics · 26 commands · api 2017-07-25
lookoutvisionAmazon Lookout for Vision · 22 commands · api 2020-11-20
m2AWSMainframeModernization · 37 commands · api 2021-04-28
machinelearningAmazon Machine Learning · 28 commands · api 2014-12-12
macieAmazon Macie · 7 commands · api 2017-12-19
macie2Amazon Macie 2 · 81 commands · api 2020-01-01
mailmanagerMailManager · 60 commands · api 2023-10-17
managedblockchainAmazon Managed Blockchain · 27 commands · api 2018-09-24
managedblockchain-queryAmazon Managed Blockchain Query · 9 commands · api 2023-05-04
marketplace-agreementAWS Marketplace Agreement Service · 7 commands · api 2020-03-01
marketplace-catalogAWS Marketplace Catalog Service · 13 commands · api 2018-09-17
marketplace-deploymentAWS Marketplace Deployment Service · 4 commands · api 2023-01-25
marketplace-entitlementAWS Marketplace Entitlement Service · 1 commands · api 2017-01-11
marketplace-reportingAWS Marketplace Reporting Service · 1 commands · api 2018-05-10
marketplacecommerceanalyticsAWS Marketplace Commerce Analytics · 2 commands · api 2015-07-01
mediaconnectAWS MediaConnect · 82 commands · api 2018-11-14
mediaconvertAWS Elemental MediaConvert · 34 commands · api 2017-08-29
medialiveAWS Elemental MediaLive · 123 commands · api 2017-10-14
mediapackageAWS Elemental MediaPackage · 19 commands · api 2017-10-12
mediapackage-vodAWS Elemental MediaPackage VOD · 17 commands · api 2018-11-07
mediapackagev2AWS Elemental MediaPackage v2 · 30 commands · api 2022-12-25
mediastoreAWS Elemental MediaStore · 21 commands · api 2017-09-01
mediastore-dataAWS Elemental MediaStore Data Plane · 5 commands · api 2017-09-01
mediatailorAWS MediaTailor · 44 commands · api 2018-04-23
medical-imagingAWS Health Imaging · 18 commands · api 2023-07-19
memorydbAmazon MemoryDB · 45 commands · api 2021-01-01
meteringmarketplaceAWSMarketplace Metering · 4 commands · api 2016-01-14
mghAWS Migration Hub · 21 commands · api 2017-05-31
mgnApplication Migration Service · 95 commands · api 2020-02-26
migration-hub-refactor-spacesAWS Migration Hub Refactor Spaces · 24 commands · api 2021-10-26
migrationhub-configAWS Migration Hub Config · 4 commands · api 2019-06-30
migrationhuborchestratorAWS Migration Hub Orchestrator · 31 commands · api 2021-08-28
migrationhubstrategyMigration Hub Strategy Recommendations · 22 commands · api 2020-02-19
mobileAWS Mobile · 9 commands · api 2017-07-01
mpaAWS Multi-party Approval · 22 commands · api 2022-07-26
mqAmazonMQ · 24 commands · api 2017-11-27
mturkAmazon Mechanical Turk · 39 commands · api 2017-01-17
mwaaAmazonMWAA · 12 commands · api 2020-07-01
mwaa-serverlessAmazonMWAAServerless · 15 commands · api 2024-07-26
neptuneAmazon Neptune · 70 commands · api 2014-10-31
neptune-graphAmazon Neptune Graph · 34 commands · api 2023-11-29
neptunedataAmazon NeptuneData · 43 commands · api 2023-08-01
network-firewallAWS Network Firewall · 79 commands · api 2020-11-12
networkflowmonitorNetwork Flow Monitor · 25 commands · api 2023-04-19
networkmanagerAWS Network Manager · 95 commands · api 2019-07-05
networkmonitorAmazon CloudWatch Network Monitor · 12 commands · api 2023-08-01
nimbleAmazonNimbleStudio · 47 commands · api 2020-08-01
notificationsAWS User Notifications · 39 commands · api 2018-05-10
notificationscontactsAWS User Notifications Contacts · 9 commands · api 2018-05-10
nova-actNova Act Service · 16 commands · api 2025-08-22
oamCloudWatch Observability Access Manager · 15 commands · api 2022-06-10
observabilityadminCloudWatch Observability Admin Service · 40 commands · api 2018-05-10
odbodb · 43 commands · api 2024-08-20
omicsAmazon Omics · 103 commands · api 2022-11-28
opensearchAmazon OpenSearch Service · 82 commands · api 2021-01-01
opensearchserverlessOpenSearch Service Serverless · 46 commands · api 2021-11-01
opsworksAWS OpsWorks · 74 commands · api 2013-02-18
opsworkscmAWS OpsWorks CM · 19 commands · api 2016-11-01
organizationsAWS Organizations · 63 commands · api 2016-11-28
osisAmazon OpenSearch Ingestion · 22 commands · api 2022-01-01
outpostsAWS Outposts · 35 commands · api 2019-12-03
panoramaAWS Panorama · 34 commands · api 2019-07-24
partnercentral-accountPartner Central Account API · 29 commands · api 2025-04-04
partnercentral-benefitsPartner Central Benefits API · 17 commands · api 2018-05-10
partnercentral-channelPartner Central Channel API · 17 commands · api 2024-03-18
partnercentral-sellingPartner Central Selling API · 42 commands · api 2022-07-26
payment-cryptographyPayment Cryptography Control Plane · 26 commands · api 2021-09-14
payment-cryptography-dataPayment Cryptography Data Plane · 14 commands · api 2022-02-03
pca-connector-adPcaConnectorAd · 25 commands · api 2018-05-10
pca-connector-scepPrivate CA Connector for SCEP · 12 commands · api 2018-05-10
pcsAWS Parallel Computing Service · 19 commands · api 2023-02-10
personalizeAmazon Personalize · 71 commands · api 2018-05-22
personalize-eventsAmazon Personalize Events · 5 commands · api 2018-03-22
personalize-runtimeAmazon Personalize Runtime · 3 commands · api 2018-05-22
piAWS Performance Insights · 13 commands · api 2018-02-27
pinpointAmazon Pinpoint · 122 commands · api 2016-12-01
pinpoint-emailAmazon Pinpoint Email Service · 42 commands · api 2018-07-26
pinpoint-sms-voiceAmazon Pinpoint SMS and Voice Service · 8 commands · api 2018-09-05
pinpoint-sms-voice-v2Amazon Pinpoint SMS Voice V2 · 91 commands · api 2022-03-31
pipesAmazon EventBridge Pipes · 10 commands · api 2015-10-07
pollyAmazon Polly · 10 commands · api 2016-06-10
pricingAWS Price List Service · 5 commands · api 2017-10-15
protonAWS Proton · 87 commands · api 2020-07-20
qappsQApps · 35 commands · api 2023-11-27
qbusinessQBusiness · 83 commands · api 2023-11-27
qconnectAmazon Q Connect · 93 commands · api 2020-10-19
qldbAmazon QLDB · 20 commands · api 2019-01-02
qldb-sessionAmazon QLDB Session · 1 commands · api 2019-07-11
quicksightAmazon QuickSight · 230 commands · api 2018-04-01
ramAWS Resource Access Manager · 35 commands · api 2018-01-04
rbinAmazon Recycle Bin · 10 commands · api 2021-06-15
rdsAmazon Relational Database Service · 163 commands · api 2014-10-31
rds-dataAWS RDS DataService · 6 commands · api 2018-08-01
redshiftAmazon Redshift · 141 commands · api 2012-12-01
redshift-dataRedshift Data API Service · 11 commands · api 2019-12-20
redshift-serverlessRedshift Serverless · 65 commands · api 2021-04-21
rekognitionAmazon Rekognition · 75 commands · api 2016-06-27
repostspaceAWS re:Post Private · 19 commands · api 2022-05-13
resiliencehubAWS Resilience Hub · 63 commands · api 2020-04-30
resource-explorer-2AWS Resource Explorer · 32 commands · api 2022-07-28
resource-groupsAWS Resource Groups · 23 commands · api 2017-11-27
resourcegroupstaggingapiAWS Resource Groups Tagging API · 9 commands · api 2017-01-26
robomakerAWS RoboMaker · 57 commands · api 2018-06-29
rolesanywhereIAM Roles Anywhere · 30 commands · api 2018-05-10
route53Amazon Route 53 · 71 commands · api 2013-04-01
route53-recovery-clusterRoute53 Recovery Cluster · 4 commands · api 2019-12-02
route53-recovery-control-configAWS Route53 Recovery Control Config · 25 commands · api 2020-11-02
route53-recovery-readinessAWS Route53 Recovery Readiness · 32 commands · api 2019-12-02
route53domainsAmazon Route 53 Domains · 34 commands · api 2014-05-15
route53globalresolverAmazon Route 53 Global Resolver · 47 commands · api 2022-09-27
route53profilesRoute 53 Profiles · 16 commands · api 2018-05-10
route53resolverAmazon Route 53 Resolver · 68 commands · api 2018-04-01
rtbfabricRTBFabric · 27 commands · api 2023-05-15
rumCloudWatch RUM · 20 commands · api 2018-05-10
s3Amazon Simple Storage Service · 111 commands · api 2006-03-01
s3apicustom command family (not a service model)
s3controlAWS S3 Control · 97 commands · api 2018-08-20
s3outpostsAmazon S3 on Outposts · 5 commands · api 2017-07-25
s3tablesAmazon S3 Tables · 49 commands · api 2018-05-10
s3vectorsAmazon S3 Vectors · 19 commands · api 2025-07-15
sagemakerAmazon SageMaker Service · 381 commands · api 2017-07-24
sagemaker-a2i-runtimeAmazon Augmented AI Runtime · 5 commands · api 2019-11-07
sagemaker-edgeAmazon Sagemaker Edge Manager · 3 commands · api 2020-09-23
sagemaker-featurestore-runtimeAmazon SageMaker Feature Store Runtime · 4 commands · api 2020-07-01
sagemaker-geospatialAmazon SageMaker geospatial capabilities · 19 commands · api 2020-05-27
sagemaker-metricsAmazon SageMaker Metrics Service · 2 commands · api 2022-09-30
sagemaker-runtimeAmazon SageMaker Runtime · 3 commands · api 2017-05-13
savingsplansAWS Savings Plans · 10 commands · api 2019-06-28
schedulerAmazon EventBridge Scheduler · 12 commands · api 2021-06-30
schemasSchemas · 31 commands · api 2019-12-02
sdbAmazon SimpleDB · 10 commands · api 2009-04-15
secretsmanagerAWS Secrets Manager · 23 commands · api 2017-10-17
security-irSecurity Incident Response · 24 commands · api 2018-05-10
securityhubAWS SecurityHub · 107 commands · api 2018-10-26
securitylakeAmazon Security Lake · 31 commands · api 2018-05-10
serverlessrepoAWSServerlessApplicationRepository · 14 commands · api 2017-09-08
service-quotasService Quotas · 26 commands · api 2019-06-24
servicecatalogAWS Service Catalog · 90 commands · api 2015-12-10
servicecatalog-appregistryAWS Service Catalog App Registry · 24 commands · api 2020-06-24
servicediscoveryAWS Cloud Map · 30 commands · api 2017-03-14
sesAmazon Simple Email Service · 71 commands · api 2010-12-01
sesv2Amazon Simple Email Service · 110 commands · api 2019-09-27
shieldAWS Shield · 36 commands · api 2016-06-02
signerAWS Signer · 19 commands · api 2017-08-25
signer-dataAWS Signer Data Plane · 1 commands · api 2017-08-25
signinAWS Sign-In Service · 1 commands · api 2023-01-01
simpledbv2Amazon SimpleDB v2 · 3 commands · api 2025-09-26
simspaceweaverAWS SimSpace Weaver · 16 commands · api 2022-10-28
smsAWS Server Migration Service · 35 commands · api 2016-10-24
snow-device-managementAWS Snow Device Management · 13 commands · api 2021-08-04
snowballAmazon Import/Export Snowball · 27 commands · api 2016-06-30
snsAmazon Simple Notification Service · 42 commands · api 2010-03-31
socialmessagingAWS End User Messaging Social · 21 commands · api 2024-01-01
sqsAmazon Simple Queue Service · 23 commands · api 2012-11-05
ssmAmazon Simple Systems Manager (SSM) · 146 commands · api 2014-11-06
ssm-contactsAWS Systems Manager Incident Manager Contacts · 39 commands · api 2021-05-03
ssm-guiconnectAWS SSM-GUIConnect · 3 commands · api 2021-05-01
ssm-incidentsAWS Systems Manager Incident Manager · 31 commands · api 2018-05-10
ssm-quicksetupAWS Systems Manager QuickSetup · 14 commands · api 2018-05-10
ssm-sapAWS Systems Manager for SAP · 27 commands · api 2018-05-10
ssoAWS Single Sign-On · 4 commands · api 2019-06-10
sso-adminAWS Single Sign-On Admin · 79 commands · api 2020-07-20
sso-oidcAWS SSO OIDC · 4 commands · api 2019-06-10
stepfunctionsAWS Step Functions · 37 commands · api 2016-11-23
storagegatewayAWS Storage Gateway · 96 commands · api 2013-06-30
stsAWS Security Token Service · 11 commands · api 2011-06-15
supplychainAWS Supply Chain · 30 commands · api 2024-01-01
supportAWS Support · 16 commands · api 2013-04-15
support-appAWS Support App · 10 commands · api 2021-08-20
swfAmazon Simple Workflow Service · 39 commands · api 2012-01-25
syntheticsSynthetics · 22 commands · api 2017-10-11
taxsettingsTax Settings · 16 commands · api 2018-05-10
textractAmazon Textract · 25 commands · api 2018-06-27
timestream-influxdbTimestream InfluxDB · 19 commands · api 2023-01-27
timestream-queryAmazon Timestream Query · 15 commands · api 2018-11-01
timestream-writeAmazon Timestream Write · 19 commands · api 2018-11-01
tnbAWS Telco Network Builder · 33 commands · api 2008-10-21
transcribeAmazon Transcribe Service · 43 commands · api 2017-10-26
transferAWS Transfer Family · 71 commands · api 2018-11-05
translateAmazon Translate · 19 commands · api 2017-07-01
trustedadvisorTrustedAdvisor Public API · 11 commands · api 2022-09-15
uxcAWS User Experience Customization · 3 commands · api 2024-07-01
verifiedpermissionsAmazon Verified Permissions · 34 commands · api 2021-12-01
voice-idAmazon Voice ID · 29 commands · api 2021-09-27
vpc-latticeAmazon VPC Lattice · 73 commands · api 2022-11-30
wafAWS WAF · 77 commands · api 2015-08-24
waf-regionalAWS WAF Regional · 81 commands · api 2016-11-28
wafv2AWS WAFV2 · 55 commands · api 2019-07-29
wellarchitectedAWS Well-Architected Tool · 72 commands · api 2020-03-31
wickrAWS Wickr Admin API · 44 commands · api 2024-02-01
wisdomAmazon Connect Wisdom Service · 41 commands · api 2020-10-19
workdocsAmazon WorkDocs · 44 commands · api 2016-05-01
worklinkAmazon WorkLink · 33 commands · api 2018-09-25
workmailAmazon WorkMail · 92 commands · api 2017-10-01
workmailmessageflowAmazon WorkMail Message Flow · 2 commands · api 2019-05-01
workspacesAmazon WorkSpaces · 91 commands · api 2015-04-08
workspaces-instancesAmazon Workspaces Instances · 13 commands · api 2022-07-26
workspaces-thin-clientAmazon WorkSpaces Thin Client · 16 commands · api 2023-08-22
workspaces-webAmazon WorkSpaces Web · 75 commands · api 2020-07-08
xrayAWS X-Ray · 38 commands · api 2016-04-12

aws sts

11

AWS Security Token Service · api 2011-06-15 · 11 commands

assume-roleReturns a set of temporary security credentials that you can use to access Amazon Web Services resources · --role-arn --role-session-name
assume-role-with-samlReturns a set of temporary security credentials for users who have been authenticated via a SAML authentication response · --role-arn --principal-arn --saml-assertion
assume-role-with-web-identityReturns a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider · --role-arn --role-session-name --web-identity-token
assume-rootReturns a set of short term credentials you can use to perform privileged tasks on a member account in your organization · --target-principal --task-policy-arn
decode-authorization-messageDecodes additional information about the authorization status of a request from an encoded message returned in response to an Amazon Web Services request · --encoded-message
get-access-key-infoReturns the account identifier for the specified access key ID · --access-key-id
get-caller-identityReturns details about the IAM user or role whose credentials are used to call the operation
get-delegated-access-tokenExchanges a trade-in token for temporary Amazon Web Services credentials with the permissions associated with the assumed principal · --trade-in-token
get-federation-tokenReturns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a user · --name
get-session-tokenReturns a set of temporary credentials for an Amazon Web Services account or IAM user
get-web-identity-tokenReturns a signed JSON Web Token (JWT) that represents the calling Amazon Web Services identity · --audience --signing-algorithm

aws iam

176

AWS Identity and Access Management · api 2010-05-08 · 176 commands

accept-delegation-requestAccepts a delegation request, granting the requested temporary access · --delegation-request-id
add-client-id-to-open-id-connect-providerAdds a new client ID (also known as audience) to the list of client IDs already registered for the specified IAM OpenID Connect (OIDC) provider resource · --open-id-connect-provider-arn --client-id
add-role-to-instance-profileAdds the specified IAM role to the specified instance profile · --instance-profile-name --role-name
add-user-to-groupAdds the specified user to the specified group. · --group-name --user-name
associate-delegation-requestAssociates a delegation request with the current identity · --delegation-request-id
attach-group-policyAttaches the specified managed policy to the specified IAM group · --group-name --policy-arn
attach-role-policyAttaches the specified managed policy to the specified IAM role · --role-name --policy-arn
attach-user-policyAttaches the specified managed policy to the specified user · --user-name --policy-arn
change-passwordChanges the password of the IAM user who is calling this operation · --old-password --new-password
create-access-keyCreates a new Amazon Web Services secret access key and corresponding Amazon Web Services access key ID for the specified user
create-account-aliasCreates an alias for your Amazon Web Services account · --account-alias
create-delegation-requestCreates an IAM delegation request for temporary access delegation · --description --permissions --requestor-workflow-id --notification-channel --session-duration
create-groupCreates a new group · --group-name
create-instance-profileCreates a new instance profile · --instance-profile-name
create-login-profileCreates a password for the specified IAM user
create-open-id-connect-providerCreates an IAM entity to describe an identity provider (IdP) that supports OpenID Connect (OIDC) · --url
create-policyCreates a new managed policy for your Amazon Web Services account · --policy-name --policy-document
create-policy-versionCreates a new version of the specified managed policy · --policy-arn --policy-document
create-roleCreates a new role for your Amazon Web Services account · --role-name --assume-role-policy-document
create-saml-providerCreates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0 · --saml-metadata-document --name
create-service-linked-roleCreates an IAM role that is linked to a specific Amazon Web Services service · --aws-service-name
create-service-specific-credentialGenerates a set of credentials consisting of a user name and password that can be used to access the service specified in the request · --user-name --service-name
create-userCreates a new IAM user for your Amazon Web Services account · --user-name
create-virtual-mfa-deviceCreates a new virtual MFA device for the Amazon Web Services account · --virtual-mfa-device-name
deactivate-mfa-deviceDeactivates the specified MFA device and removes it from association with the user name for which it was originally enabled · --serial-number
delete-access-keyDeletes the access key pair associated with the specified IAM user · --access-key-id
delete-account-aliasDeletes the specified Amazon Web Services account alias · --account-alias
delete-account-password-policyDeletes the password policy for the Amazon Web Services account
delete-groupDeletes the specified IAM group · --group-name
delete-group-policyDeletes the specified inline policy that is embedded in the specified IAM group · --group-name --policy-name
delete-instance-profileDeletes the specified instance profile · --instance-profile-name
delete-login-profileDeletes the password for the specified IAM user or root user, For more information, see Managing passwords for IAM users
delete-open-id-connect-providerDeletes an OpenID Connect identity provider (IdP) resource object in IAM · --open-id-connect-provider-arn
delete-policyDeletes the specified managed policy · --policy-arn
delete-policy-versionDeletes the specified version from the specified managed policy · --policy-arn --version-id
delete-roleDeletes the specified role · --role-name
delete-role-permissions-boundaryDeletes the permissions boundary for the specified IAM role · --role-name
delete-role-policyDeletes the specified inline policy that is embedded in the specified IAM role · --role-name --policy-name
delete-saml-providerDeletes a SAML provider resource in IAM · --saml-provider-arn
delete-ssh-public-keyDeletes the specified SSH public key · --user-name --ssh-public-key-id
delete-server-certificateDeletes the specified server certificate · --server-certificate-name
delete-service-linked-roleSubmits a service-linked role deletion request and returns a DeletionTaskId, which you can use to check the status of the deletion · --role-name
delete-service-specific-credentialDeletes the specified service-specific credential. · --service-specific-credential-id
delete-signing-certificateDeletes a signing certificate associated with the specified IAM user · --certificate-id
delete-userDeletes the specified IAM user · --user-name
delete-user-permissions-boundaryDeletes the permissions boundary for the specified IAM user · --user-name
delete-user-policyDeletes the specified inline policy that is embedded in the specified IAM user · --user-name --policy-name
delete-virtual-mfa-deviceDeletes a virtual MFA device · --serial-number
detach-group-policyRemoves the specified managed policy from the specified IAM group · --group-name --policy-arn
detach-role-policyRemoves the specified managed policy from the specified role · --role-name --policy-arn
detach-user-policyRemoves the specified managed policy from the specified user · --user-name --policy-arn
disable-organizations-root-credentials-managementDisables the management of privileged root user credentials across member accounts in your organization
disable-organizations-root-sessionsDisables root user sessions for privileged tasks across member accounts in your organization
disable-outbound-web-identity-federationDisables the outbound identity federation feature for your Amazon Web Services account
enable-mfa-deviceEnables the specified MFA device and associates it with the specified IAM user · --user-name --serial-number --authentication-code1 --authentication-code2
enable-organizations-root-credentials-managementEnables the management of privileged root user credentials across member accounts in your organization
enable-organizations-root-sessionsAllows the management account or delegated administrator to perform privileged tasks on member accounts in your organization
enable-outbound-web-identity-federationEnables the outbound identity federation feature for your Amazon Web Services account
generate-credential-reportGenerates a credential report for the Amazon Web Services account
generate-organizations-access-reportGenerates a report for service last accessed data for Organizations · --entity-path
generate-service-last-accessed-detailsGenerates a report that includes details about when an IAM resource (user, group, role, or policy) was last used in an attempt to access Amazon Web Services services · --arn
get-access-key-last-usedRetrieves information about when the specified access key was last used · --access-key-id
get-account-authorization-detailsRetrieves information about all IAM users, groups, roles, and policies in your Amazon Web Services account, including their relationships to one another
get-account-password-policyRetrieves the password policy for the Amazon Web Services account
get-account-summaryRetrieves information about IAM entity usage and IAM quotas in the Amazon Web Services account
get-context-keys-for-custom-policyGets a list of all of the context keys referenced in the input policies · --policy-input-list
get-context-keys-for-principal-policyGets a list of all of the context keys referenced in all the IAM policies that are attached to the specified IAM entity · --policy-source-arn
get-credential-reportRetrieves a credential report for the Amazon Web Services account
get-delegation-requestRetrieves information about a specific delegation request · --delegation-request-id
get-groupReturns a list of IAM users that are in the specified IAM group · --group-name
get-group-policyRetrieves the specified inline policy document that is embedded in the specified IAM group · --group-name --policy-name
get-human-readable-summaryRetrieves a human readable summary for a given entity · --entity-arn
get-instance-profileRetrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role · --instance-profile-name
get-login-profileRetrieves the user name for the specified IAM user
get-mfa-deviceRetrieves information about an MFA device for a specified user. · --serial-number
get-open-id-connect-providerReturns information about the specified OpenID Connect (OIDC) provider resource object in IAM. · --open-id-connect-provider-arn
get-organizations-access-reportRetrieves the service last accessed data report for Organizations that was previously generated using the GenerateOrganizationsAccessReport operation · --job-id
get-outbound-web-identity-federation-infoRetrieves the configuration information for the outbound identity federation feature in your Amazon Web Services account
get-policyRetrieves information about the specified managed policy, including the policy's default version and the total number of IAM users, groups, and roles to which the policy · --policy-arn
get-policy-versionRetrieves information about the specified version of the specified managed policy, including the policy document · --policy-arn --version-id
get-roleRetrieves information about the specified role, including the role's path, GUID, ARN, and the role's trust policy that grants permission to assume the role · --role-name
get-role-policyRetrieves the specified inline policy document that is embedded with the specified IAM role · --role-name --policy-name
get-saml-providerReturns the SAML provider metadocument that was uploaded when the IAM SAML provider resource object was created or updated · --saml-provider-arn
get-ssh-public-keyRetrieves the specified SSH public key, including metadata about the key · --user-name --ssh-public-key-id --encoding
get-server-certificateRetrieves information about the specified server certificate stored in IAM · --server-certificate-name
get-service-last-accessed-detailsRetrieves a service last accessed report that was created using the GenerateServiceLastAccessedDetails operation · --job-id
get-service-last-accessed-details-with-entitiesAfter you generate a group or policy report using the GenerateServiceLastAccessedDetails operation, you can use the JobId parameter in GetServiceLastAccessedDetailsWithEn · --job-id --service-namespace
get-service-linked-role-deletion-statusRetrieves the status of your service-linked role deletion · --deletion-task-id
get-userRetrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN
get-user-policyRetrieves the specified inline policy document that is embedded in the specified IAM user · --user-name --policy-name
list-access-keysReturns information about the access key IDs associated with the specified IAM user
list-account-aliasesLists the account alias associated with the Amazon Web Services account (Note: you can have only one)
list-attached-group-policiesLists all managed policies that are attached to the specified IAM group · --group-name
list-attached-role-policiesLists all managed policies that are attached to the specified IAM role · --role-name
list-attached-user-policiesLists all managed policies that are attached to the specified IAM user · --user-name
list-delegation-requestsLists delegation requests based on the specified criteria
list-entities-for-policyLists all IAM users, groups, and roles that the specified managed policy is attached to · --policy-arn
list-group-policiesLists the names of the inline policies that are embedded in the specified IAM group · --group-name
list-groupsLists the IAM groups that have the specified path prefix
list-groups-for-userLists the IAM groups that the specified IAM user belongs to · --user-name
list-instance-profile-tagsLists the tags that are attached to the specified IAM instance profile · --instance-profile-name
list-instance-profilesLists the instance profiles that have the specified path prefix
list-instance-profiles-for-roleLists the instance profiles that have the specified associated IAM role · --role-name
list-mfa-device-tagsLists the tags that are attached to the specified IAM virtual multi-factor authentication (MFA) device · --serial-number
list-mfa-devicesLists the MFA devices for an IAM user
list-open-id-connect-provider-tagsLists the tags that are attached to the specified OpenID Connect (OIDC)-compatible identity provider · --open-id-connect-provider-arn
list-open-id-connect-providersLists information about the IAM OpenID Connect (OIDC) provider resource objects defined in the Amazon Web Services account
list-organizations-featuresLists the centralized root access features enabled for your organization
list-policiesLists all the managed policies that are available in your Amazon Web Services account, including your own customer-defined managed policies and all Amazon Web Services ma
list-policies-granting-service-accessRetrieves a list of policies that the IAM identity (user, group, or role) can use to access each specified service · --arn --service-namespaces
list-policy-tagsLists the tags that are attached to the specified IAM customer managed policy · --policy-arn
list-policy-versionsLists information about the versions of the specified managed policy, including the version that is currently set as the policy's default version · --policy-arn
list-role-policiesLists the names of the inline policies that are embedded in the specified IAM role · --role-name
list-role-tagsLists the tags that are attached to the specified role · --role-name
list-rolesLists the IAM roles that have the specified path prefix
list-saml-provider-tagsLists the tags that are attached to the specified Security Assertion Markup Language (SAML) identity provider · --saml-provider-arn
list-saml-providersLists the SAML provider resource objects defined in IAM in the account
list-ssh-public-keysReturns information about the SSH public keys associated with the specified IAM user
list-server-certificate-tagsLists the tags that are attached to the specified IAM server certificate · --server-certificate-name
list-server-certificatesLists the server certificates stored in IAM that have the specified path prefix
list-service-specific-credentialsReturns information about the service-specific credentials associated with the specified IAM user
list-signing-certificatesReturns information about the signing certificates associated with the specified IAM user
list-user-policiesLists the names of the inline policies embedded in the specified IAM user · --user-name
list-user-tagsLists the tags that are attached to the specified IAM user · --user-name
list-usersLists the IAM users that have the specified path prefix
list-virtual-mfa-devicesLists the virtual MFA devices defined in the Amazon Web Services account by assignment status
put-group-policyAdds or updates an inline policy document that is embedded in the specified IAM group · --group-name --policy-name --policy-document
put-role-permissions-boundaryAdds or updates the policy that is specified as the IAM role's permissions boundary · --role-name --permissions-boundary
put-role-policyAdds or updates an inline policy document that is embedded in the specified IAM role · --role-name --policy-name --policy-document
put-user-permissions-boundaryAdds or updates the policy that is specified as the IAM user's permissions boundary · --user-name --permissions-boundary
put-user-policyAdds or updates an inline policy document that is embedded in the specified IAM user · --user-name --policy-name --policy-document
reject-delegation-requestRejects a delegation request, denying the requested temporary access · --delegation-request-id
remove-client-id-from-open-id-connect-providerRemoves the specified client ID (also known as audience) from the list of client IDs registered for the specified IAM OpenID Connect (OIDC) provider resource object · --open-id-connect-provider-arn --client-id
remove-role-from-instance-profileRemoves the specified IAM role from the specified Amazon EC2 instance profile · --instance-profile-name --role-name
remove-user-from-groupRemoves the specified user from the specified group. · --group-name --user-name
reset-service-specific-credentialResets the password for a service-specific credential · --service-specific-credential-id
resync-mfa-deviceSynchronizes the specified MFA device with its IAM resource object on the Amazon Web Services servers · --user-name --serial-number --authentication-code1 --authentication-code2
send-delegation-tokenSends the exchange token for an accepted delegation request · --delegation-request-id
set-default-policy-versionSets the specified version of the specified policy as the policy's default (operative) version · --policy-arn --version-id
set-security-token-service-preferencesSets the specified version of the global endpoint token as the token version used for the Amazon Web Services account · --global-endpoint-token-version
simulate-custom-policySimulate how a set of IAM policies and optionally a resource-based policy works with a list of API operations and Amazon Web Services resources to determine the policies' · --policy-input-list --action-names
simulate-principal-policySimulate how a set of IAM policies attached to an IAM entity works with a list of API operations and Amazon Web Services resources to determine the policies' effective pe · --policy-source-arn --action-names
tag-instance-profileAdds one or more tags to an IAM instance profile · --instance-profile-name --tags
tag-mfa-deviceAdds one or more tags to an IAM virtual multi-factor authentication (MFA) device · --serial-number --tags
tag-open-id-connect-providerAdds one or more tags to an OpenID Connect (OIDC)-compatible identity provider · --open-id-connect-provider-arn --tags
tag-policyAdds one or more tags to an IAM customer managed policy · --policy-arn --tags
tag-roleAdds one or more tags to an IAM role · --role-name --tags
tag-saml-providerAdds one or more tags to a Security Assertion Markup Language (SAML) identity provider · --saml-provider-arn --tags
tag-server-certificateAdds one or more tags to an IAM server certificate · --server-certificate-name --tags
tag-userAdds one or more tags to an IAM user · --user-name --tags
untag-instance-profileRemoves the specified tags from the IAM instance profile · --instance-profile-name --tag-keys
untag-mfa-deviceRemoves the specified tags from the IAM virtual multi-factor authentication (MFA) device · --serial-number --tag-keys
untag-open-id-connect-providerRemoves the specified tags from the specified OpenID Connect (OIDC)-compatible identity provider in IAM · --open-id-connect-provider-arn --tag-keys
untag-policyRemoves the specified tags from the customer managed policy · --policy-arn --tag-keys
untag-roleRemoves the specified tags from the role · --role-name --tag-keys
untag-saml-providerRemoves the specified tags from the specified Security Assertion Markup Language (SAML) identity provider in IAM · --saml-provider-arn --tag-keys
untag-server-certificateRemoves the specified tags from the IAM server certificate · --server-certificate-name --tag-keys
untag-userRemoves the specified tags from the user · --user-name --tag-keys
update-access-keyChanges the status of the specified access key from Active to Inactive, or vice versa · --access-key-id --status
update-account-password-policyUpdates the password policy settings for the Amazon Web Services account
update-assume-role-policyUpdates the policy that grants an IAM entity permission to assume a role · --role-name --policy-document
update-delegation-requestUpdates an existing delegation request with additional information · --delegation-request-id
update-groupUpdates the name and/or the path of the specified IAM group · --group-name
update-login-profileChanges the password for the specified IAM user · --user-name
update-open-id-connect-provider-thumbprintReplaces the existing list of server certificate thumbprints associated with an OpenID Connect (OIDC) provider resource object with a new list of thumbprints · --open-id-connect-provider-arn --thumbprint-list
update-roleUpdates the description or maximum session duration setting of a role. · --role-name
update-role-descriptionUse UpdateRole instead · --role-name --description
update-saml-providerUpdates the metadata document, SAML encryption settings, and private keys for an existing SAML provider · --saml-provider-arn
update-ssh-public-keySets the status of an IAM user's SSH public key to active or inactive · --user-name --ssh-public-key-id --status
update-server-certificateUpdates the name and/or the path of the specified server certificate stored in IAM · --server-certificate-name
update-service-specific-credentialSets the status of a service-specific credential to Active or Inactive · --service-specific-credential-id --status
update-signing-certificateChanges the status of the specified user signing certificate from active to disabled, or vice versa · --certificate-id --status
update-userUpdates the name and/or the path of the specified IAM user · --user-name
upload-ssh-public-keyUploads an SSH public key and associates it with the specified IAM user · --user-name --ssh-public-key-body
upload-server-certificateUploads a server certificate entity for the Amazon Web Services account · --server-certificate-name --certificate-body --private-key
upload-signing-certificateUploads an X.509 signing certificate and associates it with the specified IAM user · --certificate-body

aws s3api

111

Amazon Simple Storage Service · api 2006-03-01 · 111 commands

abort-multipart-uploadThis operation aborts a multipart upload · --bucket --key --upload-id
complete-multipart-uploadCompletes a multipart upload by assembling previously uploaded parts · --bucket --key --upload-id
copy-objectCreates a copy of an object that is already stored in Amazon S3 · --bucket --copy-source --key
create-bucketThis action creates an Amazon S3 bucket · --bucket
create-bucket-metadata-configurationCreates an S3 Metadata V2 metadata configuration for a general purpose bucket · --bucket --metadata-configuration
create-bucket-metadata-table-configurationWe recommend that you create your S3 Metadata configurations by using the V2 CreateBucketMetadataConfiguration API operation · --bucket --metadata-table-configuration
create-multipart-uploadEnd of support notice: As of October 1, 2025, Amazon S3 has discontinued support for Email Grantee Access Control Lists (ACLs) · --bucket --key
create-sessionCreates a session that establishes temporary security credentials to support fast authentication and authorization for the Zonal endpoint API operations on directory buck · --bucket
delete-bucketDeletes the S3 bucket · --bucket
delete-bucket-analytics-configurationThis operation is not supported for directory buckets · --bucket --id
delete-bucket-corsThis operation is not supported for directory buckets · --bucket
delete-bucket-encryptionThis implementation of the DELETE action resets the default encryption for the bucket as server-side encryption with Amazon S3 managed keys (SSE-S3) · --bucket
delete-bucket-intelligent-tiering-configurationThis operation is not supported for directory buckets · --bucket --id
delete-bucket-inventory-configurationThis operation is not supported for directory buckets · --bucket --id
delete-bucket-lifecycleDeletes the lifecycle configuration from the specified bucket · --bucket
delete-bucket-metadata-configurationDeletes an S3 Metadata configuration from a general purpose bucket · --bucket
delete-bucket-metadata-table-configurationWe recommend that you delete your S3 Metadata configurations by using the V2 DeleteBucketMetadataTableConfiguration API operation · --bucket
delete-bucket-metrics-configurationThis operation is not supported for directory buckets · --bucket --id
delete-bucket-ownership-controlsThis operation is not supported for directory buckets · --bucket
delete-bucket-policyDeletes the policy of a specified bucket · --bucket
delete-bucket-replicationThis operation is not supported for directory buckets · --bucket
delete-bucket-taggingThis operation is not supported for directory buckets · --bucket
delete-bucket-websiteThis operation is not supported for directory buckets · --bucket
delete-objectRemoves an object from a bucket · --bucket --key
delete-object-taggingThis operation is not supported for directory buckets · --bucket --key
delete-objectsThis operation enables you to delete multiple objects from a bucket using a single HTTP request · --bucket --delete
delete-public-access-blockThis operation is not supported for directory buckets · --bucket
get-bucket-abacReturns the attribute-based access control (ABAC) property of the general purpose bucket · --bucket
get-bucket-accelerate-configurationThis operation is not supported for directory buckets · --bucket
get-bucket-aclThis operation is not supported for directory buckets · --bucket
get-bucket-analytics-configurationThis operation is not supported for directory buckets · --bucket --id
get-bucket-corsThis operation is not supported for directory buckets · --bucket
get-bucket-encryptionReturns the default encryption configuration for an Amazon S3 bucket · --bucket
get-bucket-intelligent-tiering-configurationThis operation is not supported for directory buckets · --bucket --id
get-bucket-inventory-configurationThis operation is not supported for directory buckets · --bucket --id
get-bucket-lifecycleFor an updated version of this API, see GetBucketLifecycleConfiguration · --bucket
get-bucket-lifecycle-configurationReturns the lifecycle configuration information set on the bucket · --bucket
get-bucket-locationUsing the GetBucketLocation operation is no longer a best practice · --bucket
get-bucket-loggingThis operation is not supported for directory buckets · --bucket
get-bucket-metadata-configurationRetrieves the S3 Metadata configuration for a general purpose bucket · --bucket
get-bucket-metadata-table-configurationWe recommend that you retrieve your S3 Metadata configurations by using the V2 GetBucketMetadataTableConfiguration API operation · --bucket
get-bucket-metrics-configurationThis operation is not supported for directory buckets · --bucket --id
get-bucket-notificationThis operation is not supported for directory buckets · --bucket
get-bucket-notification-configurationThis operation is not supported for directory buckets · --bucket
get-bucket-ownership-controlsThis operation is not supported for directory buckets · --bucket
get-bucket-policyReturns the policy of a specified bucket · --bucket
get-bucket-policy-statusThis operation is not supported for directory buckets · --bucket
get-bucket-replicationThis operation is not supported for directory buckets · --bucket
get-bucket-request-paymentThis operation is not supported for directory buckets · --bucket
get-bucket-taggingThis operation is not supported for directory buckets · --bucket
get-bucket-versioningThis operation is not supported for directory buckets · --bucket
get-bucket-websiteThis operation is not supported for directory buckets · --bucket
get-objectRetrieves an object from Amazon S3 · --bucket --key
get-object-aclThis operation is not supported for directory buckets · --bucket --key
get-object-attributesRetrieves all of the metadata from an object without returning the object itself · --bucket --key --object-attributes
get-object-legal-holdThis operation is not supported for directory buckets · --bucket --key
get-object-lock-configurationThis operation is not supported for directory buckets · --bucket
get-object-retentionThis operation is not supported for directory buckets · --bucket --key
get-object-taggingThis operation is not supported for directory buckets · --bucket --key
get-object-torrentThis operation is not supported for directory buckets · --bucket --key
get-public-access-blockThis operation is not supported for directory buckets · --bucket
head-bucketYou can use this operation to determine if a bucket exists and if you have permission to access it · --bucket
head-objectThe HEAD operation retrieves metadata from an object without returning the object itself · --bucket --key
list-bucket-analytics-configurationsThis operation is not supported for directory buckets · --bucket
list-bucket-intelligent-tiering-configurationsThis operation is not supported for directory buckets · --bucket
list-bucket-inventory-configurationsThis operation is not supported for directory buckets · --bucket
list-bucket-metrics-configurationsThis operation is not supported for directory buckets · --bucket
list-bucketsThis operation is not supported for directory buckets
list-directory-bucketsReturns a list of all Amazon S3 directory buckets owned by the authenticated sender of the request
list-multipart-uploadsThis operation lists in-progress multipart uploads in a bucket · --bucket
list-object-versionsThis operation is not supported for directory buckets · --bucket
list-objectsThis operation is not supported for directory buckets · --bucket
list-objects-v2Returns some or all (up to 1,000) of the objects in a bucket with each request · --bucket
list-partsLists the parts that have been uploaded for a specific multipart upload · --bucket --key --upload-id
put-bucket-abacSets the attribute-based access control (ABAC) property of the general purpose bucket · --bucket --abac-status
put-bucket-accelerate-configurationThis operation is not supported for directory buckets · --bucket --accelerate-configuration
put-bucket-aclEnd of support notice: As of October 1, 2025, Amazon S3 has discontinued support for Email Grantee Access Control Lists (ACLs) · --bucket
put-bucket-analytics-configurationThis operation is not supported for directory buckets · --bucket --id --analytics-configuration
put-bucket-corsThis operation is not supported for directory buckets · --bucket --cors-configuration
put-bucket-encryptionThis operation configures default encryption and Amazon S3 Bucket Keys for an existing bucket · --bucket --server-side-encryption-configuration
put-bucket-intelligent-tiering-configurationThis operation is not supported for directory buckets · --bucket --id --intelligent-tiering-configuration
put-bucket-inventory-configurationThis operation is not supported for directory buckets · --bucket --id --inventory-configuration
put-bucket-lifecycleThis operation is not supported for directory buckets · --bucket
put-bucket-lifecycle-configurationCreates a new lifecycle configuration for the bucket or replaces an existing lifecycle configuration · --bucket
put-bucket-loggingEnd of support notice: As of October 1, 2025, Amazon S3 has discontinued support for Email Grantee Access Control Lists (ACLs) · --bucket --bucket-logging-status
put-bucket-metrics-configurationThis operation is not supported for directory buckets · --bucket --id --metrics-configuration
put-bucket-notificationThis operation is not supported for directory buckets · --bucket --notification-configuration
put-bucket-notification-configurationThis operation is not supported for directory buckets · --bucket --notification-configuration
put-bucket-ownership-controlsThis operation is not supported for directory buckets · --bucket --ownership-controls
put-bucket-policyApplies an Amazon S3 bucket policy to an Amazon S3 bucket · --bucket --policy
put-bucket-replicationThis operation is not supported for directory buckets · --bucket --replication-configuration
put-bucket-request-paymentThis operation is not supported for directory buckets · --bucket --request-payment-configuration
put-bucket-taggingThis operation is not supported for directory buckets · --bucket --tagging
put-bucket-versioningThis operation is not supported for directory buckets · --bucket --versioning-configuration
put-bucket-websiteThis operation is not supported for directory buckets · --bucket --website-configuration
put-objectEnd of support notice: As of October 1, 2025, Amazon S3 has discontinued support for Email Grantee Access Control Lists (ACLs) · --bucket --key
put-object-aclEnd of support notice: As of October 1, 2025, Amazon S3 has discontinued support for Email Grantee Access Control Lists (ACLs) · --bucket --key
put-object-legal-holdThis operation is not supported for directory buckets · --bucket --key
put-object-lock-configurationThis operation is not supported for directory buckets · --bucket
put-object-retentionThis operation is not supported for directory buckets · --bucket --key
put-object-taggingThis operation is not supported for directory buckets · --bucket --key --tagging
put-public-access-blockThis operation is not supported for directory buckets · --bucket --public-access-block-configuration
rename-objectRenames an existing object in a directory bucket that uses the S3 Express One Zone storage class · --bucket --key --rename-source
restore-objectThis operation is not supported for directory buckets · --bucket --key
select-object-contentThis operation is not supported for directory buckets · --bucket --key --expression --expression-type --input-serialization --output-serialization
update-bucket-metadata-inventory-table-configurationEnables or disables a live inventory table for an S3 Metadata configuration on a general purpose bucket · --bucket --inventory-table-configuration
update-bucket-metadata-journal-table-configurationEnables or disables journal table record expiration for an S3 Metadata configuration on a general purpose bucket · --bucket --journal-table-configuration
update-object-encryptionThis operation is not supported for directory buckets or Amazon S3 on Outposts buckets · --bucket --key --object-encryption
upload-partUploads a part in a multipart upload · --bucket --key --part-number --upload-id
upload-part-copyUploads a part by copying data from an existing object as data source · --bucket --copy-source --key --part-number --upload-id
write-get-object-responseThis operation is not supported for directory buckets · --request-route --request-token

aws ec2

756

Amazon Elastic Compute Cloud · api 2016-11-15 · 756 commands

accept-address-transferAccepts an Elastic IP address transfer · --address
accept-capacity-reservation-billing-ownershipAccepts a request to assign billing of the available capacity of a shared Capacity Reservation to your account · --capacity-reservation-id
accept-reserved-instances-exchange-quoteAccepts the Convertible Reserved Instance exchange quote described in the GetReservedInstancesExchangeQuote call. · --reserved-instance-ids
accept-transit-gateway-multicast-domain-associationsAccepts a request to associate subnets with a transit gateway multicast domain.
accept-transit-gateway-peering-attachmentAccepts a transit gateway peering attachment request · --transit-gateway-attachment-id
accept-transit-gateway-vpc-attachmentAccepts a request to attach a VPC to a transit gateway · --transit-gateway-attachment-id
accept-vpc-endpoint-connectionsAccepts connection requests to your VPC endpoint service. · --service-id --vpc-endpoint-ids
accept-vpc-peering-connectionAccept a VPC peering connection request · --vpc-peering-connection-id
advertise-byoip-cidrAdvertises an IPv4 or IPv6 address range that is provisioned for use with your Amazon Web Services resources through bring your own IP addresses (BYOIP) · --cidr
allocate-addressAllocates an Elastic IP address to your Amazon Web Services account
allocate-hostsAllocates a Dedicated Host to your account
allocate-ipam-pool-cidrAllocate a CIDR from an IPAM pool · --ipam-pool-id
apply-security-groups-to-client-vpn-target-networkApplies a security group to the association between the target network and the Client VPN endpoint · --client-vpn-endpoint-id --vpc-id --security-group-ids
assign-ipv6-addressesAssigns the specified IPv6 addresses to the specified network interface · --network-interface-id
assign-private-ip-addressesAssigns the specified secondary private IP addresses to the specified network interface · --network-interface-id
assign-private-nat-gateway-addressAssigns private IPv4 addresses to a private NAT gateway · --nat-gateway-id
associate-addressAssociates an Elastic IP address, or carrier IP address (for instances that are in subnets in Wavelength Zones) with an instance or a network interface
associate-capacity-reservation-billing-ownerInitiates a request to assign billing of the unused capacity of a shared Capacity Reservation to a consumer account that is consolidated under the same Amazon Web Service · --capacity-reservation-id --unused-reservation-billing-owner-id
associate-client-vpn-target-networkAssociates a target network with a Client VPN endpoint · --client-vpn-endpoint-id --subnet-id
associate-dhcp-optionsAssociates a set of DHCP options (that you've previously created) with the specified VPC, or associates no DHCP options with the VPC · --dhcp-options-id --vpc-id
associate-enclave-certificate-iam-roleAssociates an Identity and Access Management (IAM) role with an Certificate Manager (ACM) certificate · --certificate-arn --role-arn
associate-iam-instance-profileAssociates an IAM instance profile with a running or stopped instance · --iam-instance-profile --instance-id
associate-instance-event-windowAssociates one or more targets with an event window · --instance-event-window-id --association-target
associate-ipam-byoasnAssociates your Autonomous System Number (ASN) with a BYOIP CIDR that you own in the same Amazon Web Services Region · --asn --cidr
associate-ipam-resource-discoveryAssociates an IPAM resource discovery with an Amazon VPC IPAM · --ipam-id --ipam-resource-discovery-id
associate-nat-gateway-addressAssociates Elastic IP addresses (EIPs) and private IPv4 addresses with a public NAT gateway · --nat-gateway-id --allocation-ids
associate-route-serverAssociates a route server with a VPC to enable dynamic route updates · --route-server-id --vpc-id
associate-route-tableAssociates a subnet in your VPC or an internet gateway or virtual private gateway attached to your VPC with a route table in your VPC · --route-table-id
associate-security-group-vpcAssociates a security group with another VPC in the same Region · --group-id --vpc-id
associate-subnet-cidr-blockAssociates a CIDR block with your subnet · --subnet-id
associate-transit-gateway-multicast-domainAssociates the specified subnets and transit gateway attachments with the specified transit gateway multicast domain · --transit-gateway-multicast-domain-id --transit-gateway-attachment-id --subnet-ids
associate-transit-gateway-policy-tableAssociates the specified transit gateway attachment with a transit gateway policy table. · --transit-gateway-policy-table-id --transit-gateway-attachment-id
associate-transit-gateway-route-tableAssociates the specified attachment with the specified transit gateway route table · --transit-gateway-route-table-id --transit-gateway-attachment-id
associate-trunk-interfaceAssociates a branch network interface with a trunk network interface · --branch-interface-id --trunk-interface-id
associate-vpc-cidr-blockAssociates a CIDR block with your VPC · --vpc-id
attach-classic-link-vpcThis action is deprecated · --instance-id --vpc-id --groups
attach-internet-gatewayAttaches an internet gateway or a virtual private gateway to a VPC, enabling connectivity between the internet and the VPC · --internet-gateway-id --vpc-id
attach-network-interfaceAttaches a network interface to an instance. · --network-interface-id --instance-id --device-index
attach-verified-access-trust-providerAttaches the specified Amazon Web Services Verified Access trust provider to the specified Amazon Web Services Verified Access instance. · --verified-access-instance-id --verified-access-trust-provider-id
attach-volumeAttaches an Amazon EBS volume to a running or stopped instance, and exposes it to the instance with the specified device name · --device --instance-id --volume-id
attach-vpn-gatewayAttaches an available virtual private gateway to a VPC · --vpc-id --vpn-gateway-id
authorize-client-vpn-ingressAdds an ingress authorization rule to a Client VPN endpoint · --client-vpn-endpoint-id --target-network-cidr
authorize-security-group-egressAdds the specified outbound (egress) rules to a security group · --group-id
authorize-security-group-ingressAdds the specified inbound (ingress) rules to a security group
bundle-instanceBundles an Amazon instance store-backed Windows instance · --instance-id --storage
cancel-bundle-taskCancels a bundling operation for an instance store-backed Windows instance. · --bundle-id
cancel-capacity-reservationCancels the specified Capacity Reservation, releases the reserved capacity, and changes the Capacity Reservation's state to cancelled · --capacity-reservation-id
cancel-capacity-reservation-fleetsCancels one or more Capacity Reservation Fleets · --capacity-reservation-fleet-ids
cancel-conversion-taskCancels an active conversion task · --conversion-task-id
cancel-declarative-policies-reportCancels the generation of an account status report · --report-id
cancel-export-taskCancels an active export task · --export-task-id
cancel-image-launch-permissionRemoves your Amazon Web Services account from the launch permissions for the specified AMI · --image-id
cancel-import-taskCancels an in-process import virtual machine or import snapshot task.
cancel-reserved-instances-listingCancels the specified Reserved Instance listing in the Reserved Instance Marketplace · --reserved-instances-listing-id
cancel-spot-fleet-requestsCancels the specified Spot Fleet requests · --spot-fleet-request-ids --terminate-instances
cancel-spot-instance-requestsCancels one or more Spot Instance requests · --spot-instance-request-ids
confirm-product-instanceDetermines whether a product code is associated with an instance · --instance-id --product-code
copy-fpga-imageCopies the specified Amazon FPGA Image (AFI) to the current Region. · --source-fpga-image-id --source-region
copy-imageInitiates an AMI copy operation · --name --source-image-id --source-region
copy-snapshotCreates an exact copy of an Amazon EBS snapshot · --source-region --source-snapshot-id
copy-volumesCreates a crash-consistent, point-in-time copy of an existing Amazon EBS volume within the same Availability Zone · --source-volume-id
create-capacity-manager-data-exportCreates a new data export configuration for EC2 Capacity Manager · --s3-bucket-name --schedule --output-format
create-capacity-reservationCreates a new Capacity Reservation with the specified attributes · --instance-type --instance-platform --instance-count
create-capacity-reservation-by-splittingCreate a new Capacity Reservation by splitting the capacity of the source Capacity Reservation · --source-capacity-reservation-id --instance-count
create-capacity-reservation-fleetCreates a Capacity Reservation Fleet · --instance-type-specifications --total-target-capacity
create-carrier-gatewayCreates a carrier gateway · --vpc-id
create-client-vpn-endpointCreates a Client VPN endpoint · --server-certificate-arn --authentication-options --connection-log-options
create-client-vpn-routeAdds a route to a network to a Client VPN endpoint · --client-vpn-endpoint-id --destination-cidr-block --target-vpc-subnet-id
create-coip-cidrCreates a range of customer-owned IP addresses. · --cidr --coip-pool-id
create-coip-poolCreates a pool of customer-owned IP (CoIP) addresses. · --local-gateway-route-table-id
create-customer-gatewayProvides information to Amazon Web Services about your customer gateway device · --type
create-default-subnetCreates a default subnet with a size /20 IPv4 CIDR block in the specified Availability Zone in your default VPC
create-default-vpcCreates a default VPC with a size /16 IPv4 CIDR block and a default subnet in each Availability Zone
create-delegate-mac-volume-ownership-taskDelegates ownership of the Amazon EBS root volume for an Apple silicon Mac instance to an administrative user. · --instance-id --mac-credentials
create-dhcp-optionsCreates a custom set of DHCP options · --dhcp-configurations
create-egress-only-internet-gateway[IPv6 only] Creates an egress-only internet gateway for your VPC · --vpc-id
create-fleetCreates an EC2 Fleet that contains the configuration information for On-Demand Instances and Spot Instances · --launch-template-configs --target-capacity-specification
create-flow-logsCreates one or more flow logs to capture information about IP traffic for a specific network interface, subnet, or VPC · --resource-ids --resource-type
create-fpga-imageCreates an Amazon FPGA Image (AFI) from the specified design checkpoint (DCP) · --input-storage-location
create-imageCreates an Amazon EBS-backed AMI from an Amazon EBS-backed instance that is either running or stopped · --instance-id --name
create-image-usage-reportCreates a report that shows how your image is used across other Amazon Web Services accounts · --image-id --resource-types
create-instance-connect-endpointCreates an EC2 Instance Connect Endpoint · --subnet-id
create-instance-event-windowCreates an event window in which scheduled events for the associated Amazon EC2 instances can run
create-instance-export-taskExports a running or stopped instance to an Amazon S3 bucket · --instance-id --target-environment --export-to-s3-task
create-internet-gatewayCreates an internet gateway for use with a VPC
create-interruptible-capacity-reservation-allocationCreates an interruptible Capacity Reservation by specifying the number of unused instances you want to allocate from your source reservation · --capacity-reservation-id --instance-count
create-ipamCreate an IPAM
create-ipam-external-resource-verification-tokenCreate a verification token · --ipam-id
create-ipam-policyCreates an IPAM policy · --ipam-id
create-ipam-poolCreate an IP address pool for Amazon VPC IP Address Manager (IPAM) · --ipam-scope-id --address-family
create-ipam-prefix-list-resolverCreates an IPAM prefix list resolver · --ipam-id --address-family
create-ipam-prefix-list-resolver-targetCreates an IPAM prefix list resolver target · --ipam-prefix-list-resolver-id --prefix-list-id --prefix-list-region --track-latest-version
create-ipam-resource-discoveryCreates an IPAM resource discovery
create-ipam-scopeCreate an IPAM scope · --ipam-id
create-key-pairCreates an ED25519 or 2048-bit RSA key pair with the specified name and in the specified format · --key-name
create-launch-templateCreates a launch template · --launch-template-name --launch-template-data
create-launch-template-versionCreates a new version of a launch template · --launch-template-data
create-local-gateway-routeCreates a static route for the specified local gateway route table · --local-gateway-route-table-id
create-local-gateway-route-tableCreates a local gateway route table. · --local-gateway-id
create-local-gateway-route-table-virtual-interface-group-associationCreates a local gateway route table virtual interface group association. · --local-gateway-route-table-id --local-gateway-virtual-interface-group-id
create-local-gateway-route-table-vpc-associationAssociates the specified VPC with the specified local gateway route table. · --local-gateway-route-table-id --vpc-id
create-local-gateway-virtual-interfaceCreate a virtual interface for a local gateway. · --local-gateway-virtual-interface-group-id --outpost-lag-id --vlan --local-address --peer-address
create-local-gateway-virtual-interface-groupCreate a local gateway virtual interface group. · --local-gateway-id
create-mac-system-integrity-protection-modification-taskCreates a System Integrity Protection (SIP) modification task to configure the SIP settings for an x86 Mac instance or Apple silicon Mac instance · --instance-id --mac-system-integrity-protection-status
create-managed-prefix-listCreates a managed prefix list · --prefix-list-name --max-entries --address-family
create-nat-gatewayCreates a NAT gateway in the specified subnet
create-network-aclCreates a network ACL in a VPC · --vpc-id
create-network-acl-entryCreates an entry (a rule) in a network ACL with the specified rule number · --network-acl-id --rule-number --protocol --rule-action --egress
create-network-insights-access-scopeCreates a Network Access Scope · --client-token
create-network-insights-pathCreates a path to analyze for reachability · --source --protocol --client-token
create-network-interfaceCreates a network interface in the specified subnet · --subnet-id
create-network-interface-permissionGrants an Amazon Web Services-authorized account permission to attach the specified network interface to an instance in their account · --network-interface-id --permission
create-placement-groupCreates a placement group in which to launch instances
create-public-ipv4-poolCreates a public IPv4 address pool
create-replace-root-volume-taskReplaces the EBS-backed root volume for a running instance with a new volume that is restored to the original root volume's launch state, that is restored to a specific s · --instance-id
create-reserved-instances-listingCreates a listing for Amazon EC2 Standard Reserved Instances to be sold in the Reserved Instance Marketplace · --reserved-instances-id --instance-count --price-schedules --client-token
create-restore-image-taskStarts a task that restores an AMI from an Amazon S3 object that was previously created by using CreateStoreImageTask · --bucket --object-key
create-routeCreates a route in a route table within a VPC · --route-table-id
create-route-serverCreates a new route server to manage dynamic routing in a VPC · --amazon-side-asn
create-route-server-endpointCreates a new endpoint for a route server in a specified subnet · --route-server-id --subnet-id
create-route-server-peerCreates a new BGP peer for a specified route server endpoint · --route-server-endpoint-id --peer-address --bgp-options
create-route-tableCreates a route table for the specified VPC · --vpc-id
create-secondary-networkCreates a secondary network · --ipv4-cidr-block --network-type
create-secondary-subnetCreates a secondary subnet in a secondary network · --ipv4-cidr-block --secondary-network-id
create-security-groupCreates a security group · --description --group-name
create-snapshotCreates a snapshot of an EBS volume and stores it in Amazon S3 · --volume-id
create-snapshotsCreates crash-consistent snapshots of multiple EBS volumes attached to an Amazon EC2 instance · --instance-specification
create-spot-datafeed-subscriptionCreates a data feed for Spot Instances, enabling you to view Spot Instance usage logs · --bucket
create-store-image-taskStores an AMI as a single object in an Amazon S3 bucket · --image-id --bucket
create-subnetCreates a subnet in the specified VPC · --vpc-id
create-subnet-cidr-reservationCreates a subnet CIDR reservation · --subnet-id --cidr --reservation-type
create-tagsAdds or overwrites only the specified tags for the specified Amazon EC2 resource or resources · --resources --tags
create-traffic-mirror-filterCreates a Traffic Mirror filter
create-traffic-mirror-filter-ruleCreates a Traffic Mirror filter rule · --traffic-mirror-filter-id --traffic-direction --rule-number --rule-action --destination-cidr-block --source-cidr-block
create-traffic-mirror-sessionCreates a Traffic Mirror session · --network-interface-id --traffic-mirror-target-id --traffic-mirror-filter-id --session-number
create-traffic-mirror-targetCreates a target for your Traffic Mirror session
create-transit-gatewayCreates a transit gateway
create-transit-gateway-connectCreates a Connect attachment from a specified transit gateway attachment · --transport-transit-gateway-attachment-id --options
create-transit-gateway-connect-peerCreates a Connect peer for a specified transit gateway Connect attachment between a transit gateway and an appliance · --transit-gateway-attachment-id --peer-address --inside-cidr-blocks
create-transit-gateway-metering-policyCreates a metering policy for a transit gateway to track and measure network traffic. · --transit-gateway-id
create-transit-gateway-metering-policy-entryCreates an entry in a transit gateway metering policy to define traffic measurement rules. · --transit-gateway-metering-policy-id --policy-rule-number --metered-account
create-transit-gateway-multicast-domainCreates a multicast domain using the specified transit gateway · --transit-gateway-id
create-transit-gateway-peering-attachmentRequests a transit gateway peering attachment between the specified transit gateway (requester) and a peer transit gateway (accepter) · --transit-gateway-id --peer-transit-gateway-id --peer-account-id --peer-region
create-transit-gateway-policy-tableCreates a transit gateway policy table. · --transit-gateway-id
create-transit-gateway-prefix-list-referenceCreates a reference (route) to a prefix list in a specified transit gateway route table. · --transit-gateway-route-table-id --prefix-list-id
create-transit-gateway-routeCreates a static route for the specified transit gateway route table. · --destination-cidr-block --transit-gateway-route-table-id
create-transit-gateway-route-tableCreates a route table for the specified transit gateway. · --transit-gateway-id
create-transit-gateway-route-table-announcementAdvertises a new transit gateway route table. · --transit-gateway-route-table-id --peering-attachment-id
create-transit-gateway-vpc-attachmentAttaches the specified VPC to the specified transit gateway · --transit-gateway-id --vpc-id --subnet-ids
create-verified-access-endpointAn Amazon Web Services Verified Access endpoint is where you define your application along with an optional endpoint-level access policy. · --verified-access-group-id --endpoint-type --attachment-type
create-verified-access-groupAn Amazon Web Services Verified Access group is a collection of Amazon Web Services Verified Access endpoints who's associated applications have similar security requirem · --verified-access-instance-id
create-verified-access-instanceAn Amazon Web Services Verified Access instance is a regional entity that evaluates application requests and grants access only when your security requirements are met.
create-verified-access-trust-providerA trust provider is a third-party entity that creates, maintains, and manages identity information for users and devices · --trust-provider-type --policy-reference-name
create-volumeCreates an EBS volume that can be attached to an instance in the same Availability Zone
create-vpcCreates a VPC with the specified CIDR blocks
create-vpc-block-public-access-exclusionCreate a VPC Block Public Access (BPA) exclusion · --internet-gateway-exclusion-mode
create-vpc-encryption-controlCreates a VPC Encryption Control configuration for a specified VPC · --vpc-id
create-vpc-endpointCreates a VPC endpoint · --vpc-id
create-vpc-endpoint-connection-notificationCreates a connection notification for a specified VPC endpoint or VPC endpoint service · --connection-notification-arn --connection-events
create-vpc-endpoint-service-configurationCreates a VPC endpoint service to which service consumers (Amazon Web Services accounts, users, and IAM roles) can connect
create-vpc-peering-connectionRequests a VPC peering connection between two VPCs: a requester VPC that you own and an accepter VPC with which to create the connection · --vpc-id
create-vpn-concentratorCreates a VPN concentrator that aggregates multiple VPN connections to a transit gateway. · --type
create-vpn-connectionCreates a VPN connection between an existing virtual private gateway or transit gateway and a customer gateway · --customer-gateway-id --type
create-vpn-connection-routeCreates a static route associated with a VPN connection between an existing virtual private gateway and a VPN customer gateway · --destination-cidr-block --vpn-connection-id
create-vpn-gatewayCreates a virtual private gateway · --type
delete-capacity-manager-data-exportDeletes an existing Capacity Manager data export configuration · --capacity-manager-data-export-id
delete-carrier-gatewayDeletes a carrier gateway · --carrier-gateway-id
delete-client-vpn-endpointDeletes the specified Client VPN endpoint · --client-vpn-endpoint-id
delete-client-vpn-routeDeletes a route from a Client VPN endpoint · --client-vpn-endpoint-id --destination-cidr-block
delete-coip-cidrDeletes a range of customer-owned IP addresses. · --cidr --coip-pool-id
delete-coip-poolDeletes a pool of customer-owned IP (CoIP) addresses. · --coip-pool-id
delete-customer-gatewayDeletes the specified customer gateway · --customer-gateway-id
delete-dhcp-optionsDeletes the specified set of DHCP options · --dhcp-options-id
delete-egress-only-internet-gatewayDeletes an egress-only internet gateway. · --egress-only-internet-gateway-id
delete-fleetsDeletes the specified EC2 Fleet request · --fleet-ids --terminate-instances
delete-flow-logsDeletes one or more flow logs. · --flow-log-ids
delete-fpga-imageDeletes the specified Amazon FPGA Image (AFI). · --fpga-image-id
delete-image-usage-reportDeletes the specified image usage report · --report-id
delete-instance-connect-endpointDeletes the specified EC2 Instance Connect Endpoint. · --instance-connect-endpoint-id
delete-instance-event-windowDeletes the specified event window · --instance-event-window-id
delete-internet-gatewayDeletes the specified internet gateway · --internet-gateway-id
delete-ipamDelete an IPAM · --ipam-id
delete-ipam-external-resource-verification-tokenDelete a verification token · --ipam-external-resource-verification-token-id
delete-ipam-policyDeletes an IPAM policy · --ipam-policy-id
delete-ipam-poolDelete an IPAM pool · --ipam-pool-id
delete-ipam-prefix-list-resolverDeletes an IPAM prefix list resolver · --ipam-prefix-list-resolver-id
delete-ipam-prefix-list-resolver-targetDeletes an IPAM prefix list resolver target · --ipam-prefix-list-resolver-target-id
delete-ipam-resource-discoveryDeletes an IPAM resource discovery · --ipam-resource-discovery-id
delete-ipam-scopeDelete the scope for an IPAM · --ipam-scope-id
delete-key-pairDeletes the specified key pair, by removing the public key from Amazon EC2.
delete-launch-templateDeletes a launch template
delete-launch-template-versionsDeletes one or more versions of a launch template · --versions
delete-local-gateway-routeDeletes the specified route from the specified local gateway route table. · --local-gateway-route-table-id
delete-local-gateway-route-tableDeletes a local gateway route table. · --local-gateway-route-table-id
delete-local-gateway-route-table-virtual-interface-group-associationDeletes a local gateway route table virtual interface group association. · --local-gateway-route-table-virtual-interface-group-association-id
delete-local-gateway-route-table-vpc-associationDeletes the specified association between a VPC and local gateway route table. · --local-gateway-route-table-vpc-association-id
delete-local-gateway-virtual-interfaceDeletes the specified local gateway virtual interface. · --local-gateway-virtual-interface-id
delete-local-gateway-virtual-interface-groupDelete the specified local gateway interface group. · --local-gateway-virtual-interface-group-id
delete-managed-prefix-listDeletes the specified managed prefix list · --prefix-list-id
delete-nat-gatewayDeletes the specified NAT gateway · --nat-gateway-id
delete-network-aclDeletes the specified network ACL · --network-acl-id
delete-network-acl-entryDeletes the specified ingress or egress entry (rule) from the specified network ACL. · --network-acl-id --rule-number --egress
delete-network-insights-access-scopeDeletes the specified Network Access Scope. · --network-insights-access-scope-id
delete-network-insights-access-scope-analysisDeletes the specified Network Access Scope analysis. · --network-insights-access-scope-analysis-id
delete-network-insights-analysisDeletes the specified network insights analysis. · --network-insights-analysis-id
delete-network-insights-pathDeletes the specified path. · --network-insights-path-id
delete-network-interfaceDeletes the specified network interface · --network-interface-id
delete-network-interface-permissionDeletes a permission for a network interface · --network-interface-permission-id
delete-placement-groupDeletes the specified placement group · --group-name
delete-public-ipv4-poolDelete a public IPv4 pool · --pool-id
delete-queued-reserved-instancesDeletes the queued purchases for the specified Reserved Instances. · --reserved-instances-ids
delete-routeDeletes the specified route from the specified route table. · --route-table-id
delete-route-serverDeletes the specified route server · --route-server-id
delete-route-server-endpointDeletes the specified route server endpoint · --route-server-endpoint-id
delete-route-server-peerDeletes the specified BGP peer from a route server · --route-server-peer-id
delete-route-tableDeletes the specified route table · --route-table-id
delete-secondary-networkDeletes a secondary network · --secondary-network-id
delete-secondary-subnetDeletes a secondary subnet · --secondary-subnet-id
delete-security-groupDeletes a security group
delete-snapshotDeletes the specified snapshot · --snapshot-id
delete-spot-datafeed-subscriptionDeletes the data feed for Spot Instances.
delete-subnetDeletes the specified subnet · --subnet-id
delete-subnet-cidr-reservationDeletes a subnet CIDR reservation. · --subnet-cidr-reservation-id
delete-tagsDeletes the specified set of tags from the specified set of resources · --resources
delete-traffic-mirror-filterDeletes the specified Traffic Mirror filter · --traffic-mirror-filter-id
delete-traffic-mirror-filter-ruleDeletes the specified Traffic Mirror rule. · --traffic-mirror-filter-rule-id
delete-traffic-mirror-sessionDeletes the specified Traffic Mirror session. · --traffic-mirror-session-id
delete-traffic-mirror-targetDeletes the specified Traffic Mirror target · --traffic-mirror-target-id
delete-transit-gatewayDeletes the specified transit gateway. · --transit-gateway-id
delete-transit-gateway-connectDeletes the specified Connect attachment · --transit-gateway-attachment-id
delete-transit-gateway-connect-peerDeletes the specified Connect peer. · --transit-gateway-connect-peer-id
delete-transit-gateway-metering-policyDeletes a transit gateway metering policy. · --transit-gateway-metering-policy-id
delete-transit-gateway-metering-policy-entryDeletes an entry from a transit gateway metering policy. · --transit-gateway-metering-policy-id --policy-rule-number
delete-transit-gateway-multicast-domainDeletes the specified transit gateway multicast domain. · --transit-gateway-multicast-domain-id
delete-transit-gateway-peering-attachmentDeletes a transit gateway peering attachment. · --transit-gateway-attachment-id
delete-transit-gateway-policy-tableDeletes the specified transit gateway policy table. · --transit-gateway-policy-table-id
delete-transit-gateway-prefix-list-referenceDeletes a reference (route) to a prefix list in a specified transit gateway route table. · --transit-gateway-route-table-id --prefix-list-id
delete-transit-gateway-routeDeletes the specified route from the specified transit gateway route table. · --transit-gateway-route-table-id --destination-cidr-block
delete-transit-gateway-route-tableDeletes the specified transit gateway route table · --transit-gateway-route-table-id
delete-transit-gateway-route-table-announcementAdvertises to the transit gateway that a transit gateway route table is deleted. · --transit-gateway-route-table-announcement-id
delete-transit-gateway-vpc-attachmentDeletes the specified VPC attachment. · --transit-gateway-attachment-id
delete-verified-access-endpointDelete an Amazon Web Services Verified Access endpoint. · --verified-access-endpoint-id
delete-verified-access-groupDelete an Amazon Web Services Verified Access group. · --verified-access-group-id
delete-verified-access-instanceDelete an Amazon Web Services Verified Access instance. · --verified-access-instance-id
delete-verified-access-trust-providerDelete an Amazon Web Services Verified Access trust provider. · --verified-access-trust-provider-id
delete-volumeDeletes the specified EBS volume · --volume-id
delete-vpcDeletes the specified VPC · --vpc-id
delete-vpc-block-public-access-exclusionDelete a VPC Block Public Access (BPA) exclusion · --exclusion-id
delete-vpc-encryption-controlDeletes a VPC Encryption Control configuration · --vpc-encryption-control-id
delete-vpc-endpoint-connection-notificationsDeletes the specified VPC endpoint connection notifications. · --connection-notification-ids
delete-vpc-endpoint-service-configurationsDeletes the specified VPC endpoint service configurations · --service-ids
delete-vpc-endpointsDeletes the specified VPC endpoints · --vpc-endpoint-ids
delete-vpc-peering-connectionDeletes a VPC peering connection · --vpc-peering-connection-id
delete-vpn-concentratorDeletes the specified VPN concentrator. · --vpn-concentrator-id
delete-vpn-connectionDeletes the specified VPN connection · --vpn-connection-id
delete-vpn-connection-routeDeletes the specified static route associated with a VPN connection between an existing virtual private gateway and a VPN customer gateway · --destination-cidr-block --vpn-connection-id
delete-vpn-gatewayDeletes the specified virtual private gateway · --vpn-gateway-id
deprovision-byoip-cidrReleases the specified address range that you provisioned for use with your Amazon Web Services resources through bring your own IP addresses (BYOIP) and deletes the corr · --cidr
deprovision-ipam-byoasnDeprovisions your Autonomous System Number (ASN) from your Amazon Web Services account · --ipam-id --asn
deprovision-ipam-pool-cidrDeprovision a CIDR provisioned from an IPAM pool · --ipam-pool-id
deprovision-public-ipv4-pool-cidrDeprovision a CIDR from a public IPv4 pool. · --pool-id --cidr
deregister-imageDeregisters the specified AMI · --image-id
deregister-instance-event-notification-attributesDeregisters tag keys to prevent tags that have the specified tag keys from being included in scheduled event notifications for resources in the Region. · --instance-tag-attribute
deregister-transit-gateway-multicast-group-membersDeregisters the specified members (network interfaces) from the transit gateway multicast group.
deregister-transit-gateway-multicast-group-sourcesDeregisters the specified sources (network interfaces) from the transit gateway multicast group.
describe-account-attributesDescribes attributes of your Amazon Web Services account
describe-address-transfersDescribes an Elastic IP address transfer
describe-addressesDescribes the specified Elastic IP addresses or all of your Elastic IP addresses.
describe-addresses-attributeDescribes the attributes of the specified Elastic IP addresses
describe-aggregate-id-formatDescribes the longer ID format settings for all resource types in a specific Region
describe-availability-zonesDescribes the Availability Zones, Local Zones, and Wavelength Zones that are available to you
describe-aws-network-performance-metric-subscriptionsDescribes the current Infrastructure Performance metric subscriptions.
describe-bundle-tasksDescribes the specified bundle tasks or all of your bundle tasks
describe-byoip-cidrsDescribes the IP address ranges that were provisioned for use with Amazon Web Services resources through through bring your own IP addresses (BYOIP). · --max-results
describe-capacity-block-extension-historyDescribes the events for the specified Capacity Block extension during the specified time.
describe-capacity-block-extension-offeringsDescribes Capacity Block extension offerings available for purchase in the Amazon Web Services Region that you're currently using. · --capacity-block-extension-duration-hours --capacity-reservation-id
describe-capacity-block-offeringsDescribes Capacity Block offerings available for purchase in the Amazon Web Services Region that you're currently using · --capacity-duration-hours
describe-capacity-block-statusDescribes the availability of capacity for the specified Capacity blocks, or all of your Capacity Blocks.
describe-capacity-blocksDescribes details about Capacity Blocks in the Amazon Web Services Region that you're currently using.
describe-capacity-manager-data-exportsDescribes one or more Capacity Manager data export configurations
describe-capacity-reservation-billing-requestsDescribes a request to assign the billing of the unused capacity of a Capacity Reservation · --role
describe-capacity-reservation-fleetsDescribes one or more Capacity Reservation Fleets.
describe-capacity-reservation-topologyDescribes a tree-based hierarchy that represents the physical host placement of your pending or active Capacity Reservations within an Availability Zone or Local Zone
describe-capacity-reservationsDescribes one or more of your Capacity Reservations
describe-carrier-gatewaysDescribes one or more of your carrier gateways.
describe-classic-link-instancesThis action is deprecated
describe-client-vpn-authorization-rulesDescribes the authorization rules for a specified Client VPN endpoint. · --client-vpn-endpoint-id
describe-client-vpn-connectionsDescribes active client connections and connections that have been terminated within the last 60 minutes for the specified Client VPN endpoint. · --client-vpn-endpoint-id
describe-client-vpn-endpointsDescribes one or more Client VPN endpoints in the account.
describe-client-vpn-routesDescribes the routes for the specified Client VPN endpoint. · --client-vpn-endpoint-id
describe-client-vpn-target-networksDescribes the target networks associated with the specified Client VPN endpoint. · --client-vpn-endpoint-id
describe-coip-poolsDescribes the specified customer-owned address pools or all of your customer-owned address pools.
describe-conversion-tasksDescribes the specified conversion tasks or all your conversion tasks
describe-customer-gatewaysDescribes one or more of your VPN customer gateways
describe-declarative-policies-reportsDescribes the metadata of an account status report, including the status of the report
describe-dhcp-optionsDescribes your DHCP option sets
describe-egress-only-internet-gatewaysDescribes your egress-only internet gateways
describe-elastic-gpusAmazon Elastic Graphics reached end of life on January 8, 2024
describe-export-image-tasksDescribes the specified export image tasks or all of your export image tasks.
describe-export-tasksDescribes the specified export instance tasks or all of your export instance tasks.
describe-fast-launch-imagesDescribe details for Windows AMIs that are configured for Windows fast launch.
describe-fast-snapshot-restoresDescribes the state of fast snapshot restores for your snapshots.
describe-fleet-historyDescribes the events for the specified EC2 Fleet during the specified time · --fleet-id --start-time
describe-fleet-instancesDescribes the running instances for the specified EC2 Fleet · --fleet-id
describe-fleetsDescribes the specified EC2 Fleet or all of your EC2 Fleets
describe-flow-logsDescribes one or more flow logs
describe-fpga-image-attributeDescribes the specified attribute of the specified Amazon FPGA Image (AFI). · --fpga-image-id --attribute
describe-fpga-imagesDescribes the Amazon FPGA Images (AFIs) available to you
describe-host-reservation-offeringsDescribes the Dedicated Host reservations that are available to purchase
describe-host-reservationsDescribes reservations that are associated with Dedicated Hosts in your account.
describe-hostsDescribes the specified Dedicated Hosts or all your Dedicated Hosts
describe-iam-instance-profile-associationsDescribes your IAM instance profile associations.
describe-id-formatDescribes the ID format settings for your resources on a per-Region basis, for example, to view which resource types are enabled for longer IDs
describe-identity-id-formatDescribes the ID format settings for resources for the specified IAM user, IAM role, or root user · --principal-arn
describe-image-attributeDescribes the specified attribute of the specified AMI · --attribute --image-id
describe-image-referencesDescribes your Amazon Web Services resources that are referencing the specified images · --image-ids
describe-image-usage-report-entriesDescribes the entries in image usage reports, showing how your images are used across other Amazon Web Services accounts
describe-image-usage-reportsDescribes the configuration and status of image usage reports, filtered by report IDs or image IDs
describe-imagesDescribes the specified images (AMIs, AKIs, and ARIs) available to you or all of the images available to you
describe-import-image-tasksDisplays details about an import virtual machine or import snapshot tasks that are already created.
describe-import-snapshot-tasksDescribes your import snapshot tasks.
describe-instance-attributeDescribes the specified attribute of the specified instance · --instance-id --attribute
describe-instance-connect-endpointsDescribes the specified EC2 Instance Connect Endpoints or all EC2 Instance Connect Endpoints.
describe-instance-credit-specificationsDescribes the credit option for CPU usage of the specified burstable performance instances
describe-instance-event-notification-attributesDescribes the tag keys that are registered to appear in scheduled event notifications for resources in the current Region.
describe-instance-event-windowsDescribes the specified event windows or all event windows
describe-instance-image-metadataDescribes the AMI that was used to launch an instance, even if the AMI is deprecated, deregistered, made private (no longer public or shared with your account), or not al
describe-instance-sql-ha-history-statesDescribes the historical SQL Server High Availability states for Amazon EC2 instances that are enabled for Amazon EC2 High Availability for SQL Server monitoring.
describe-instance-sql-ha-statesDescribes the SQL Server High Availability states for Amazon EC2 instances that are enabled for Amazon EC2 High Availability for SQL Server monitoring.
describe-instance-statusDescribes the status of the specified instances or all of your instances
describe-instance-topologyDescribes a tree-based hierarchy that represents the physical host placement of your EC2 instances within an Availability Zone or Local Zone
describe-instance-type-offeringsLists the instance types that are offered for the specified location
describe-instance-typesDescribes the specified instance types
describe-instancesDescribes the specified instances or all instances
describe-internet-gatewaysDescribes your internet gateways
describe-ipam-byoasnDescribes your Autonomous System Numbers (ASNs), their provisioning statuses, and the BYOIP CIDRs with which they are associated
describe-ipam-external-resource-verification-tokensDescribe verification tokens
describe-ipam-policiesDescribes one or more IPAM policies
describe-ipam-poolsGet information about your IPAM pools.
describe-ipam-prefix-list-resolver-targetsDescribes one or more IPAM prefix list resolver Targets
describe-ipam-prefix-list-resolversDescribes one or more IPAM prefix list resolvers
describe-ipam-resource-discoveriesDescribes IPAM resource discoveries
describe-ipam-resource-discovery-associationsDescribes resource discovery association with an Amazon VPC IPAM
describe-ipam-scopesGet information about your IPAM scopes.
describe-ipamsGet information about your IPAM pools
describe-ipv6-poolsDescribes your IPv6 address pools.
describe-key-pairsDescribes the specified key pairs or all of your key pairs
describe-launch-template-versionsDescribes one or more versions of a specified launch template
describe-launch-templatesDescribes one or more launch templates.
describe-local-gateway-route-table-virtual-interface-group-associationsDescribes the associations between virtual interface groups and local gateway route tables.
describe-local-gateway-route-table-vpc-associationsDescribes the specified associations between VPCs and local gateway route tables.
describe-local-gateway-route-tablesDescribes one or more local gateway route tables
describe-local-gateway-virtual-interface-groupsDescribes the specified local gateway virtual interface groups.
describe-local-gateway-virtual-interfacesDescribes the specified local gateway virtual interfaces.
describe-local-gatewaysDescribes one or more local gateways
describe-locked-snapshotsDescribes the lock status for a snapshot.
describe-mac-hostsDescribes the specified EC2 Mac Dedicated Host or all of your EC2 Mac Dedicated Hosts.
describe-mac-modification-tasksDescribes a System Integrity Protection (SIP) modification task or volume ownership delegation task for an Amazon EC2 Mac instance
describe-managed-prefix-listsDescribes your managed prefix lists and any Amazon Web Services-managed prefix lists.
describe-moving-addressesThis action is deprecated
describe-nat-gatewaysDescribes your NAT gateways
describe-network-aclsDescribes your network ACLs
describe-network-insights-access-scope-analysesDescribes the specified Network Access Scope analyses.
describe-network-insights-access-scopesDescribes the specified Network Access Scopes.
describe-network-insights-analysesDescribes one or more of your network insights analyses.
describe-network-insights-pathsDescribes one or more of your paths.
describe-network-interface-attributeDescribes a network interface attribute · --network-interface-id
describe-network-interface-permissionsDescribes the permissions for your network interfaces.
describe-network-interfacesDescribes the specified network interfaces or all your network interfaces
describe-outpost-lagsDescribes the Outposts link aggregation groups (LAGs)
describe-placement-groupsDescribes the specified placement groups or all of your placement groups
describe-prefix-listsDescribes available Amazon Web Services services in a prefix list format, which includes the prefix list name and prefix list ID of the service and the IP address range f
describe-principal-id-formatDescribes the ID format settings for the root user and all IAM roles and IAM users that have explicitly specified a longer ID (17-character ID) preference
describe-public-ipv4-poolsDescribes the specified IPv4 address pools.
describe-regionsDescribes the Regions that are enabled for your account, or all Regions
describe-replace-root-volume-tasksDescribes a root volume replacement task
describe-reserved-instancesDescribes one or more of the Reserved Instances that you purchased
describe-reserved-instances-listingsDescribes your account's Reserved Instance listings in the Reserved Instance Marketplace
describe-reserved-instances-modificationsDescribes the modifications made to your Reserved Instances
describe-reserved-instances-offeringsDescribes Reserved Instance offerings that are available for purchase
describe-route-server-endpointsDescribes one or more route server endpoints
describe-route-server-peersDescribes one or more route server peers
describe-route-serversDescribes one or more route servers
describe-route-tablesDescribes your route tables
describe-scheduled-instance-availabilityFinds available schedules that meet the specified criteria · --first-slot-start-time-range --recurrence
describe-scheduled-instancesDescribes the specified Scheduled Instances or all your Scheduled Instances.
describe-secondary-interfacesDescribes one or more of your secondary interfaces.
describe-secondary-networksDescribes one or more secondary networks.
describe-secondary-subnetsDescribes one or more of your secondary subnets.
describe-security-group-referencesDescribes the VPCs on the other side of a VPC peering or Transit Gateway connection that are referencing the security groups you've specified in this request. · --group-id
describe-security-group-rulesDescribes one or more of your security group rules.
describe-security-group-vpc-associationsDescribes security group VPC associations made with AssociateSecurityGroupVpc.
describe-security-groupsDescribes the specified security groups or all of your security groups.
describe-service-link-virtual-interfacesDescribes the Outpost service link virtual interfaces.
describe-snapshot-attributeDescribes the specified attribute of the specified snapshot · --attribute --snapshot-id
describe-snapshot-tier-statusDescribes the storage tier status of one or more Amazon EBS snapshots.
describe-snapshotsDescribes the specified EBS snapshots available to you or all of the EBS snapshots available to you
describe-spot-datafeed-subscriptionDescribes the data feed for Spot Instances
describe-spot-fleet-instancesDescribes the running instances for the specified Spot Fleet. · --spot-fleet-request-id
describe-spot-fleet-request-historyDescribes the events for the specified Spot Fleet request during the specified time · --spot-fleet-request-id --start-time
describe-spot-fleet-requestsDescribes your Spot Fleet requests
describe-spot-instance-requestsDescribes the specified Spot Instance requests
describe-spot-price-historyDescribes the Spot price history
describe-stale-security-groupsDescribes the stale security group rules for security groups referenced across a VPC peering connection, transit gateway connection, or with a security group VPC associat · --vpc-id
describe-store-image-tasksDescribes the progress of the AMI store tasks
describe-subnetsDescribes your subnets
describe-tagsDescribes the specified tags for your EC2 resources
describe-traffic-mirror-filter-rulesDescribe traffic mirror filters that determine the traffic that is mirrored.
describe-traffic-mirror-filtersDescribes one or more Traffic Mirror filters.
describe-traffic-mirror-sessionsDescribes one or more Traffic Mirror sessions
describe-traffic-mirror-targetsInformation about one or more Traffic Mirror targets.
describe-transit-gateway-attachmentsDescribes one or more attachments between resources and transit gateways
describe-transit-gateway-connect-peersDescribes one or more Connect peers.
describe-transit-gateway-connectsDescribes one or more Connect attachments.
describe-transit-gateway-metering-policiesDescribes one or more transit gateway metering policies.
describe-transit-gateway-multicast-domainsDescribes one or more transit gateway multicast domains.
describe-transit-gateway-peering-attachmentsDescribes your transit gateway peering attachments.
describe-transit-gateway-policy-tablesDescribes one or more transit gateway route policy tables.
describe-transit-gateway-route-table-announcementsDescribes one or more transit gateway route table advertisements.
describe-transit-gateway-route-tablesDescribes one or more transit gateway route tables
describe-transit-gateway-vpc-attachmentsDescribes one or more VPC attachments
describe-transit-gatewaysDescribes one or more transit gateways
describe-trunk-interface-associationsDescribes one or more network interface trunk associations.
describe-verified-access-endpointsDescribes the specified Amazon Web Services Verified Access endpoints.
describe-verified-access-groupsDescribes the specified Verified Access groups.
describe-verified-access-instance-logging-configurationsDescribes the specified Amazon Web Services Verified Access instances.
describe-verified-access-instancesDescribes the specified Amazon Web Services Verified Access instances.
describe-verified-access-trust-providersDescribes the specified Amazon Web Services Verified Access trust providers.
describe-volume-attributeDescribes the specified attribute of the specified volume · --attribute --volume-id
describe-volume-statusDescribes the status of the specified volumes
describe-volumesDescribes the specified EBS volumes or all of your EBS volumes
describe-volumes-modificationsDescribes the most recent volume modification request for the specified EBS volumes
describe-vpc-attributeDescribes the specified attribute of the specified VPC · --attribute --vpc-id
describe-vpc-block-public-access-exclusionsDescribe VPC Block Public Access (BPA) exclusions
describe-vpc-block-public-access-optionsDescribe VPC Block Public Access (BPA) options
describe-vpc-classic-linkThis action is deprecated
describe-vpc-classic-link-dns-supportThis action is deprecated
describe-vpc-encryption-controlsDescribes one or more VPC Encryption Control configurations
describe-vpc-endpoint-associationsDescribes the VPC resources, VPC endpoint services, Amazon Lattice services, or service networks associated with the VPC endpoint.
describe-vpc-endpoint-connection-notificationsDescribes the connection notifications for VPC endpoints and VPC endpoint services.
describe-vpc-endpoint-connectionsDescribes the VPC endpoint connections to your VPC endpoint services, including any endpoints that are pending your acceptance.
describe-vpc-endpoint-service-configurationsDescribes the VPC endpoint service configurations in your account (your services).
describe-vpc-endpoint-service-permissionsDescribes the principals (service consumers) that are permitted to discover your VPC endpoint service · --service-id
describe-vpc-endpoint-servicesDescribes available services to which you can create a VPC endpoint
describe-vpc-endpointsDescribes your VPC endpoints
describe-vpc-peering-connectionsDescribes your VPC peering connections
describe-vpcsDescribes your VPCs
describe-vpn-concentratorsDescribes one or more of your VPN concentrators.
describe-vpn-connectionsDescribes one or more of your VPN connections
describe-vpn-gatewaysDescribes one or more of your virtual private gateways
detach-classic-link-vpcThis action is deprecated · --instance-id --vpc-id
detach-internet-gatewayDetaches an internet gateway from a VPC, disabling connectivity between the internet and the VPC · --internet-gateway-id --vpc-id
detach-network-interfaceDetaches a network interface from an instance. · --attachment-id
detach-verified-access-trust-providerDetaches the specified Amazon Web Services Verified Access trust provider from the specified Amazon Web Services Verified Access instance. · --verified-access-instance-id --verified-access-trust-provider-id
detach-volumeDetaches an EBS volume from an instance · --volume-id
detach-vpn-gatewayDetaches a virtual private gateway from a VPC · --vpc-id --vpn-gateway-id
disable-address-transferDisables Elastic IP address transfer · --allocation-id
disable-allowed-images-settingsDisables Allowed AMIs for your account in the specified Amazon Web Services Region
disable-aws-network-performance-metric-subscriptionDisables Infrastructure Performance metric subscriptions.
disable-capacity-managerDisables EC2 Capacity Manager for your account
disable-ebs-encryption-by-defaultDisables EBS encryption by default for your account in the current Region
disable-fast-launchDiscontinue Windows fast launch for a Windows AMI, and clean up existing pre-provisioned snapshots · --image-id
disable-fast-snapshot-restoresDisables fast snapshot restores for the specified snapshots in the specified Availability Zones. · --source-snapshot-ids
disable-imageSets the AMI state to disabled and removes all launch permissions from the AMI · --image-id
disable-image-block-public-accessDisables block public access for AMIs at the account level in the specified Amazon Web Services Region
disable-image-deprecationCancels the deprecation of the specified AMI · --image-id
disable-image-deregistration-protectionDisables deregistration protection for an AMI · --image-id
disable-instance-sql-ha-standby-detectionsDisable Amazon EC2 instances running in an SQL Server High Availability cluster from SQL Server High Availability instance standby detection monitoring · --instance-ids
disable-ipam-organization-admin-accountDisable the IPAM account · --delegated-admin-account-id
disable-ipam-policyDisables an IPAM policy · --ipam-policy-id
disable-route-server-propagationDisables route propagation from a route server to a specified route table · --route-server-id --route-table-id
disable-serial-console-accessDisables access to the EC2 serial console of all instances for your account
disable-snapshot-block-public-accessDisables the block public access for snapshots setting at the account level for the specified Amazon Web Services Region
disable-transit-gateway-route-table-propagationDisables the specified resource attachment from propagating routes to the specified propagation route table. · --transit-gateway-route-table-id
disable-vgw-route-propagationDisables a virtual private gateway (VGW) from propagating routes to a specified route table of a VPC. · --gateway-id --route-table-id
disable-vpc-classic-linkThis action is deprecated · --vpc-id
disable-vpc-classic-link-dns-supportThis action is deprecated
disassociate-addressDisassociates an Elastic IP address from the instance or network interface it's associated with
disassociate-capacity-reservation-billing-ownerCancels a pending request to assign billing of the unused capacity of a Capacity Reservation to a consumer account, or revokes a request that has already been accepted · --capacity-reservation-id --unused-reservation-billing-owner-id
disassociate-client-vpn-target-networkDisassociates a target network from the specified Client VPN endpoint · --client-vpn-endpoint-id --association-id
disassociate-enclave-certificate-iam-roleDisassociates an IAM role from an Certificate Manager (ACM) certificate · --certificate-arn --role-arn
disassociate-iam-instance-profileDisassociates an IAM instance profile from a running or stopped instance · --association-id
disassociate-instance-event-windowDisassociates one or more targets from an event window · --instance-event-window-id --association-target
disassociate-ipam-byoasnRemove the association between your Autonomous System Number (ASN) and your BYOIP CIDR · --asn --cidr
disassociate-ipam-resource-discoveryDisassociates a resource discovery from an Amazon VPC IPAM · --ipam-resource-discovery-association-id
disassociate-nat-gateway-addressDisassociates secondary Elastic IP addresses (EIPs) from a public NAT gateway · --nat-gateway-id --association-ids
disassociate-route-serverDisassociates a route server from a VPC · --route-server-id --vpc-id
disassociate-route-tableDisassociates a subnet or gateway from a route table · --association-id
disassociate-security-group-vpcDisassociates a security group from a VPC · --group-id --vpc-id
disassociate-subnet-cidr-blockDisassociates a CIDR block from a subnet · --association-id
disassociate-transit-gateway-multicast-domainDisassociates the specified subnets from the transit gateway multicast domain. · --transit-gateway-multicast-domain-id --transit-gateway-attachment-id --subnet-ids
disassociate-transit-gateway-policy-tableRemoves the association between an an attachment and a policy table. · --transit-gateway-policy-table-id --transit-gateway-attachment-id
disassociate-transit-gateway-route-tableDisassociates a resource attachment from a transit gateway route table. · --transit-gateway-route-table-id --transit-gateway-attachment-id
disassociate-trunk-interfaceRemoves an association between a branch network interface with a trunk network interface. · --association-id
disassociate-vpc-cidr-blockDisassociates a CIDR block from a VPC · --association-id
enable-address-transferEnables Elastic IP address transfer · --allocation-id --transfer-account-id
enable-allowed-images-settingsEnables Allowed AMIs for your account in the specified Amazon Web Services Region · --allowed-images-settings-state
enable-aws-network-performance-metric-subscriptionEnables Infrastructure Performance subscriptions.
enable-capacity-managerEnables EC2 Capacity Manager for your account
enable-ebs-encryption-by-defaultEnables EBS encryption by default for your account in the current Region
enable-fast-launchWhen you enable Windows fast launch for a Windows AMI, images are pre-provisioned, using snapshots to launch instances up to 65% faster · --image-id
enable-fast-snapshot-restoresEnables fast snapshot restores for the specified snapshots in the specified Availability Zones · --source-snapshot-ids
enable-imageRe-enables a disabled AMI · --image-id
enable-image-block-public-accessEnables block public access for AMIs at the account level in the specified Amazon Web Services Region · --image-block-public-access-state
enable-image-deprecationEnables deprecation of the specified AMI at the specified date and time · --image-id --deprecate-at
enable-image-deregistration-protectionEnables deregistration protection for an AMI · --image-id
enable-instance-sql-ha-standby-detectionsEnable Amazon EC2 instances running in an SQL Server High Availability cluster for SQL Server High Availability instance standby detection monitoring · --instance-ids
enable-ipam-organization-admin-accountEnable an Organizations member account as the IPAM admin account · --delegated-admin-account-id
enable-ipam-policyEnables an IPAM policy · --ipam-policy-id
enable-reachability-analyzer-organization-sharingEstablishes a trust relationship between Reachability Analyzer and Organizations
enable-route-server-propagationDefines which route tables the route server can update with routes · --route-server-id --route-table-id
enable-serial-console-accessEnables access to the EC2 serial console of all instances for your account
enable-snapshot-block-public-accessEnables or modifies the block public access for snapshots setting at the account level for the specified Amazon Web Services Region · --state
enable-transit-gateway-route-table-propagationEnables the specified attachment to propagate routes to the specified propagation route table. · --transit-gateway-route-table-id
enable-vgw-route-propagationEnables a virtual private gateway (VGW) to propagate routes to the specified route table of a VPC. · --gateway-id --route-table-id
enable-volume-ioEnables I/O operations for a volume that had I/O operations disabled because the data on the volume was potentially inconsistent. · --volume-id
enable-vpc-classic-linkThis action is deprecated · --vpc-id
enable-vpc-classic-link-dns-supportThis action is deprecated
export-client-vpn-client-certificate-revocation-listDownloads the client certificate revocation list for the specified Client VPN endpoint. · --client-vpn-endpoint-id
export-client-vpn-client-configurationDownloads the contents of the Client VPN endpoint configuration file for the specified Client VPN endpoint · --client-vpn-endpoint-id
export-imageExports an Amazon Machine Image (AMI) to a VM file · --disk-image-format --image-id --s3-export-location
export-transit-gateway-routesExports routes from the specified transit gateway route table to the specified S3 bucket · --transit-gateway-route-table-id --s3-bucket
export-verified-access-instance-client-configurationExports the client configuration for a Verified Access instance. · --verified-access-instance-id
get-active-vpn-tunnel-statusReturns the currently negotiated security parameters for an active VPN tunnel, including IKE version, DH groups, encryption algorithms, and integrity algorithms. · --vpn-connection-id --vpn-tunnel-outside-ip-address
get-allowed-images-settingsGets the current state of the Allowed AMIs setting and the list of Allowed AMIs criteria at the account level in the specified Region
get-associated-enclave-certificate-iam-rolesReturns the IAM roles that are associated with the specified ACM (ACM) certificate · --certificate-arn
get-associated-ipv6-pool-cidrsGets information about the IPv6 CIDR block associations for a specified IPv6 address pool. · --pool-id
get-aws-network-performance-dataGets network performance data.
get-capacity-manager-attributesRetrieves the current configuration and status of EC2 Capacity Manager for your account, including enablement status, Organizations access settings, and data ingestion st
get-capacity-manager-metric-dataRetrieves capacity usage metrics for your EC2 resources · --metric-names --start-time --end-time --period
get-capacity-manager-metric-dimensionsRetrieves the available dimension values for capacity metrics within a specified time range · --group-by --start-time --end-time --metric-names
get-capacity-reservation-usageGets usage information about a Capacity Reservation · --capacity-reservation-id
get-coip-pool-usageDescribes the allocations from the specified customer-owned address pool. · --pool-id
get-console-outputGets the console output for the specified instance · --instance-id
get-console-screenshotRetrieve a JPG-format screenshot of a running instance to help with troubleshooting · --instance-id
get-declarative-policies-report-summaryRetrieves a summary of the account status report · --report-id
get-default-credit-specificationDescribes the default credit option for CPU usage of a burstable performance instance family · --instance-family
get-ebs-default-kms-key-idDescribes the default KMS key for EBS encryption by default for your account in this Region
get-ebs-encryption-by-defaultDescribes whether EBS encryption by default is enabled for your account in the current Region
get-enabled-ipam-policyGets the enabled IPAM policy
get-flow-logs-integration-templateGenerates a CloudFormation template that streamlines and automates the integration of VPC flow logs with Amazon Athena · --flow-log-id --config-delivery-s3-destination-arn --integrate-services
get-groups-for-capacity-reservationLists the resource groups to which a Capacity Reservation has been added. · --capacity-reservation-id
get-host-reservation-purchase-previewPreview a reservation purchase with configurations that match those of your Dedicated Host · --host-id-set --offering-id
get-image-ancestryRetrieves the ancestry chain of the specified AMI, tracing its lineage back to the root AMI · --image-id
get-image-block-public-access-stateGets the current state of block public access for AMIs at the account level in the specified Amazon Web Services Region
get-instance-metadata-defaultsGets the default instance metadata service (IMDS) settings that are set at the account level in the specified Amazon Web Services&#x2028; Region
get-instance-tpm-ek-pubGets the public endorsement key associated with the Nitro Trusted Platform Module (NitroTPM) for the specified instance. · --instance-id --key-type --key-format
get-instance-types-from-instance-requirementsReturns a list of instance types with the specified instance attributes · --architecture-types --virtualization-types --instance-requirements
get-instance-uefi-dataA binary representation of the UEFI variable store · --instance-id
get-ipam-address-historyRetrieve historical information about a CIDR within an IPAM scope · --cidr --ipam-scope-id
get-ipam-discovered-accountsGets IPAM discovered accounts · --ipam-resource-discovery-id --discovery-region
get-ipam-discovered-public-addressesGets the public IP addresses that have been discovered by IPAM. · --ipam-resource-discovery-id --address-region
get-ipam-discovered-resource-cidrsReturns the resource CIDRs that are monitored as part of a resource discovery · --ipam-resource-discovery-id --resource-region
get-ipam-policy-allocation-rulesGets the allocation rules for an IPAM policy · --ipam-policy-id
get-ipam-policy-organization-targetsGets the Amazon Web Services Organizations targets for an IPAM policy · --ipam-policy-id
get-ipam-pool-allocationsGet a list of all the CIDR allocations in an IPAM pool · --ipam-pool-id
get-ipam-pool-cidrsGet the CIDRs provisioned to an IPAM pool. · --ipam-pool-id
get-ipam-prefix-list-resolver-rulesRetrieves the CIDR selection rules for an IPAM prefix list resolver · --ipam-prefix-list-resolver-id
get-ipam-prefix-list-resolver-version-entriesRetrieves the CIDR entries for a specific version of an IPAM prefix list resolver · --ipam-prefix-list-resolver-id --ipam-prefix-list-resolver-version
get-ipam-prefix-list-resolver-versionsRetrieves version information for an IPAM prefix list resolver · --ipam-prefix-list-resolver-id
get-ipam-resource-cidrsReturns resource CIDRs managed by IPAM in a given scope · --ipam-scope-id
get-launch-template-dataRetrieves the configuration data of the specified instance · --instance-id
get-managed-prefix-list-associationsGets information about the resources that are associated with the specified managed prefix list. · --prefix-list-id
get-managed-prefix-list-entriesGets information about the entries for a specified managed prefix list. · --prefix-list-id
get-network-insights-access-scope-analysis-findingsGets the findings for the specified Network Access Scope analysis. · --network-insights-access-scope-analysis-id
get-network-insights-access-scope-contentGets the content for the specified Network Access Scope. · --network-insights-access-scope-id
get-password-dataRetrieves the encrypted administrator password for a running Windows instance · --instance-id
get-reserved-instances-exchange-quoteReturns a quote and exchange information for exchanging one or more specified Convertible Reserved Instances for a new Convertible Reserved Instance · --reserved-instance-ids
get-route-server-associationsGets information about the associations for the specified route server · --route-server-id
get-route-server-propagationsGets information about the route propagations for the specified route server · --route-server-id
get-route-server-routing-databaseGets the routing database for the specified route server · --route-server-id
get-security-groups-for-vpcGets security groups that can be associated by the Amazon Web Services account making the request with network interfaces in the specified VPC. · --vpc-id
get-serial-console-access-statusRetrieves the access status of your account to the EC2 serial console of all instances
get-snapshot-block-public-access-stateGets the current state of block public access for snapshots setting for the account and Region
get-spot-placement-scoresCalculates the Spot placement score for a Region or Availability Zone based on the specified target capacity and compute requirements · --target-capacity
get-subnet-cidr-reservationsGets information about the subnet CIDR reservations. · --subnet-id
get-transit-gateway-attachment-propagationsLists the route tables to which the specified resource attachment propagates routes. · --transit-gateway-attachment-id
get-transit-gateway-metering-policy-entriesRetrieves the entries for a transit gateway metering policy. · --transit-gateway-metering-policy-id
get-transit-gateway-multicast-domain-associationsGets information about the associations for the transit gateway multicast domain. · --transit-gateway-multicast-domain-id
get-transit-gateway-policy-table-associationsGets a list of the transit gateway policy table associations. · --transit-gateway-policy-table-id
get-transit-gateway-policy-table-entriesReturns a list of transit gateway policy table entries. · --transit-gateway-policy-table-id
get-transit-gateway-prefix-list-referencesGets information about the prefix list references in a specified transit gateway route table. · --transit-gateway-route-table-id
get-transit-gateway-route-table-associationsGets information about the associations for the specified transit gateway route table. · --transit-gateway-route-table-id
get-transit-gateway-route-table-propagationsGets information about the route table propagations for the specified transit gateway route table. · --transit-gateway-route-table-id
get-verified-access-endpoint-policyGet the Verified Access policy associated with the endpoint. · --verified-access-endpoint-id
get-verified-access-endpoint-targetsGets the targets for the specified network CIDR endpoint for Verified Access. · --verified-access-endpoint-id
get-verified-access-group-policyShows the contents of the Verified Access policy associated with the group. · --verified-access-group-id
get-vpc-resources-blocking-encryption-enforcementGets information about resources in a VPC that are blocking encryption enforcement · --vpc-id
get-vpn-connection-device-sample-configurationDownload an Amazon Web Services-provided sample configuration file to be used with the customer gateway device specified for your Site-to-Site VPN connection. · --vpn-connection-id --vpn-connection-device-type-id
get-vpn-connection-device-typesObtain a list of customer gateway devices for which sample configuration files can be provided
get-vpn-tunnel-replacement-statusGet details of available tunnel endpoint maintenance. · --vpn-connection-id --vpn-tunnel-outside-ip-address
import-client-vpn-client-certificate-revocation-listUploads a client certificate revocation list to the specified Client VPN endpoint · --client-vpn-endpoint-id --certificate-revocation-list
import-imageTo import your virtual machines (VMs) with a console-based experience, you can use the Import virtual machine images to Amazon Web Services template in the Migration Hub
import-instanceWe recommend that you use the ImportImage API instead · --platform
import-key-pairImports the public key from an RSA or ED25519 key pair that you created using a third-party tool · --key-name --public-key-material
import-snapshotImports a disk into an EBS snapshot
import-volumeThis API action supports only single-volume VMs · --image --volume
list-images-in-recycle-binLists one or more AMIs that are currently in the Recycle Bin
list-snapshots-in-recycle-binLists one or more snapshots that are currently in the Recycle Bin.
list-volumes-in-recycle-binLists one or more volumes that are currently in the Recycle Bin.
lock-snapshotLocks an Amazon EBS snapshot in either governance or compliance mode to protect it against accidental or malicious deletions for a specific duration · --snapshot-id --lock-mode
modify-address-attributeModifies an attribute of the specified Elastic IP address · --allocation-id
modify-availability-zone-groupChanges the opt-in status of the specified zone group for your account. · --group-name --opt-in-status
modify-capacity-reservationModifies a Capacity Reservation's capacity, instance eligibility, and the conditions under which it is to be released · --capacity-reservation-id
modify-capacity-reservation-fleetModifies a Capacity Reservation Fleet · --capacity-reservation-fleet-id
modify-client-vpn-endpointModifies the specified Client VPN endpoint · --client-vpn-endpoint-id
modify-default-credit-specificationModifies the default credit option for CPU usage of burstable performance instances · --instance-family --cpu-credits
modify-ebs-default-kms-key-idChanges the default KMS key for EBS encryption by default for your account in this Region · --kms-key-id
modify-fleetModifies the specified EC2 Fleet · --fleet-id
modify-fpga-image-attributeModifies the specified attribute of the specified Amazon FPGA Image (AFI). · --fpga-image-id
modify-hostsModify the auto-placement setting of a Dedicated Host · --host-ids
modify-id-formatModifies the ID format for the specified resource on a per-Region basis · --resource --use-long-ids
modify-identity-id-formatModifies the ID format of a resource for a specified IAM user, IAM role, or the root user for an account; or all IAM users, IAM roles, and the root user for an account · --resource --use-long-ids --principal-arn
modify-image-attributeModifies the specified attribute of the specified AMI · --image-id
modify-instance-attributeModifies the specified attribute of the specified instance · --instance-id
modify-instance-capacity-reservation-attributesModifies the Capacity Reservation settings for a stopped instance · --instance-id --capacity-reservation-specification
modify-instance-connect-endpointModifies the specified EC2 Instance Connect Endpoint · --instance-connect-endpoint-id
modify-instance-cpu-optionsBy default, all vCPUs for the instance type are active when you launch an instance · --instance-id
modify-instance-credit-specificationModifies the credit option for CPU usage on a running or stopped burstable performance instance · --instance-credit-specifications
modify-instance-event-start-timeModifies the start time for a scheduled Amazon EC2 instance event. · --instance-id --instance-event-id --not-before
modify-instance-event-windowModifies the specified event window · --instance-event-window-id
modify-instance-maintenance-optionsModifies the recovery behavior of your instance to disable simplified automatic recovery or set the recovery behavior to default · --instance-id
modify-instance-metadata-defaultsModifies the default instance metadata service (IMDS) settings at the account level in the specified Amazon Web Services&#x2028; Region
modify-instance-metadata-optionsModify the instance metadata parameters on a running or stopped instance · --instance-id
modify-instance-network-performance-optionsChange the configuration of the network performance options for an existing instance. · --instance-id --bandwidth-weighting
modify-instance-placementModifies the placement attributes for a specified instance · --instance-id
modify-ipamModify the configurations of an IPAM. · --ipam-id
modify-ipam-policy-allocation-rulesModifies the allocation rules in an IPAM policy · --ipam-policy-id --locale --resource-type
modify-ipam-poolModify the configurations of an IPAM pool · --ipam-pool-id
modify-ipam-prefix-list-resolverModifies an IPAM prefix list resolver · --ipam-prefix-list-resolver-id
modify-ipam-prefix-list-resolver-targetModifies an IPAM prefix list resolver target · --ipam-prefix-list-resolver-target-id
modify-ipam-resource-cidrModify a resource CIDR · --resource-id --resource-cidr --resource-region --current-ipam-scope-id --monitored
modify-ipam-resource-discoveryModifies a resource discovery · --ipam-resource-discovery-id
modify-ipam-scopeModify an IPAM scope. · --ipam-scope-id
modify-launch-templateModifies a launch template
modify-local-gateway-routeModifies the specified local gateway route. · --local-gateway-route-table-id
modify-managed-prefix-listModifies the specified managed prefix list · --prefix-list-id
modify-network-interface-attributeModifies the specified network interface attribute · --network-interface-id
modify-private-dns-name-optionsModifies the options for instance hostnames for the specified instance. · --instance-id
modify-public-ip-dns-name-optionsModify public hostname options for a network interface · --network-interface-id --hostname-type
modify-reserved-instancesModifies the configuration of your Reserved Instances, such as the Availability Zone, instance count, or instance type · --reserved-instances-ids --target-configurations
modify-route-serverModifies the configuration of an existing route server · --route-server-id
modify-security-group-rulesModifies the rules of a security group. · --group-id --security-group-rules
modify-snapshot-attributeAdds or removes permission settings for the specified snapshot · --snapshot-id
modify-snapshot-tierArchives an Amazon EBS snapshot · --snapshot-id
modify-spot-fleet-requestModifies the specified Spot Fleet request · --spot-fleet-request-id
modify-subnet-attributeModifies a subnet attribute · --subnet-id
modify-traffic-mirror-filter-network-servicesAllows or restricts mirroring network services · --traffic-mirror-filter-id
modify-traffic-mirror-filter-ruleModifies the specified Traffic Mirror rule · --traffic-mirror-filter-rule-id
modify-traffic-mirror-sessionModifies a Traffic Mirror session. · --traffic-mirror-session-id
modify-transit-gatewayModifies the specified transit gateway · --transit-gateway-id
modify-transit-gateway-metering-policyModifies a transit gateway metering policy. · --transit-gateway-metering-policy-id
modify-transit-gateway-prefix-list-referenceModifies a reference (route) to a prefix list in a specified transit gateway route table. · --transit-gateway-route-table-id --prefix-list-id
modify-transit-gateway-vpc-attachmentModifies the specified VPC attachment. · --transit-gateway-attachment-id
modify-verified-access-endpointModifies the configuration of the specified Amazon Web Services Verified Access endpoint. · --verified-access-endpoint-id
modify-verified-access-endpoint-policyModifies the specified Amazon Web Services Verified Access endpoint policy. · --verified-access-endpoint-id
modify-verified-access-groupModifies the specified Amazon Web Services Verified Access group configuration. · --verified-access-group-id
modify-verified-access-group-policyModifies the specified Amazon Web Services Verified Access group policy. · --verified-access-group-id
modify-verified-access-instanceModifies the configuration of the specified Amazon Web Services Verified Access instance. · --verified-access-instance-id
modify-verified-access-instance-logging-configurationModifies the logging configuration for the specified Amazon Web Services Verified Access instance. · --verified-access-instance-id --access-logs
modify-verified-access-trust-providerModifies the configuration of the specified Amazon Web Services Verified Access trust provider. · --verified-access-trust-provider-id
modify-volumeYou can modify several parameters of an existing EBS volume, including volume size, volume type, and IOPS capacity · --volume-id
modify-volume-attributeModifies a volume attribute · --volume-id
modify-vpc-attributeModifies the specified attribute of the specified VPC. · --vpc-id
modify-vpc-block-public-access-exclusionModify VPC Block Public Access (BPA) exclusions · --exclusion-id --internet-gateway-exclusion-mode
modify-vpc-block-public-access-optionsModify VPC Block Public Access (BPA) options · --internet-gateway-block-mode
modify-vpc-encryption-controlModifies the encryption control configuration for a VPC · --vpc-encryption-control-id
modify-vpc-endpointModifies attributes of a specified VPC endpoint · --vpc-endpoint-id
modify-vpc-endpoint-connection-notificationModifies a connection notification for VPC endpoint or VPC endpoint service · --connection-notification-id
modify-vpc-endpoint-service-configurationModifies the attributes of the specified VPC endpoint service configuration · --service-id
modify-vpc-endpoint-service-payer-responsibilityModifies the payer responsibility for your VPC endpoint service. · --service-id --payer-responsibility
modify-vpc-endpoint-service-permissionsModifies the permissions for your VPC endpoint service · --service-id
modify-vpc-peering-connection-optionsModifies the VPC peering connection options on one side of a VPC peering connection · --vpc-peering-connection-id
modify-vpc-tenancyModifies the instance tenancy attribute of the specified VPC · --vpc-id --instance-tenancy
modify-vpn-connectionModifies the customer gateway or the target gateway of an Amazon Web Services Site-to-Site VPN connection · --vpn-connection-id
modify-vpn-connection-optionsModifies the connection options for your Site-to-Site VPN connection · --vpn-connection-id
modify-vpn-tunnel-certificateModifies the VPN tunnel endpoint certificate. · --vpn-connection-id --vpn-tunnel-outside-ip-address
modify-vpn-tunnel-optionsModifies the options for a VPN tunnel in an Amazon Web Services Site-to-Site VPN connection · --vpn-connection-id --vpn-tunnel-outside-ip-address --tunnel-options
monitor-instancesEnables detailed monitoring for a running instance · --instance-ids
move-address-to-vpcThis action is deprecated · --public-ip
move-byoip-cidr-to-ipamMove a BYOIPv4 CIDR to IPAM from a public IPv4 pool · --cidr --ipam-pool-id --ipam-pool-owner
move-capacity-reservation-instancesMove available capacity from a source Capacity Reservation to a destination Capacity Reservation · --source-capacity-reservation-id --destination-capacity-reservation-id --instance-count
provision-byoip-cidrProvisions an IPv4 or IPv6 address range for use with your Amazon Web Services resources through bring your own IP addresses (BYOIP) and creates a corresponding address p · --cidr
provision-ipam-byoasnProvisions your Autonomous System Number (ASN) for use in your Amazon Web Services account · --ipam-id --asn --asn-authorization-context
provision-ipam-pool-cidrProvision a CIDR to an IPAM pool · --ipam-pool-id
provision-public-ipv4-pool-cidrProvision a CIDR to a public IPv4 pool · --ipam-pool-id --pool-id --netmask-length
purchase-capacity-blockPurchase the Capacity Block for use with your account · --capacity-block-offering-id --instance-platform
purchase-capacity-block-extensionPurchase the Capacity Block extension for use with your account · --capacity-block-extension-offering-id --capacity-reservation-id
purchase-host-reservationPurchase a reservation with configurations that match those of your Dedicated Host · --host-id-set --offering-id
purchase-reserved-instances-offeringPurchases a Reserved Instance for use with your account · --instance-count --reserved-instances-offering-id
purchase-scheduled-instancesYou can no longer purchase Scheduled Instances · --purchase-requests
reboot-instancesRequests a reboot of the specified instances · --instance-ids
register-imageRegisters an AMI · --name
register-instance-event-notification-attributesRegisters a set of tag keys to include in scheduled event notifications for your resources · --instance-tag-attribute
register-transit-gateway-multicast-group-membersRegisters members (network interfaces) with the transit gateway multicast group · --transit-gateway-multicast-domain-id --network-interface-ids
register-transit-gateway-multicast-group-sourcesRegisters sources (network interfaces) with the specified transit gateway multicast group · --transit-gateway-multicast-domain-id --network-interface-ids
reject-capacity-reservation-billing-ownershipRejects a request to assign billing of the available capacity of a shared Capacity Reservation to your account · --capacity-reservation-id
reject-transit-gateway-multicast-domain-associationsRejects a request to associate cross-account subnets with a transit gateway multicast domain.
reject-transit-gateway-peering-attachmentRejects a transit gateway peering attachment request. · --transit-gateway-attachment-id
reject-transit-gateway-vpc-attachmentRejects a request to attach a VPC to a transit gateway · --transit-gateway-attachment-id
reject-vpc-endpoint-connectionsRejects VPC endpoint connection requests to your VPC endpoint service. · --service-id --vpc-endpoint-ids
reject-vpc-peering-connectionRejects a VPC peering connection request · --vpc-peering-connection-id
release-addressReleases the specified Elastic IP address
release-hostsWhen you no longer want to use an On-Demand Dedicated Host it can be released · --host-ids
release-ipam-pool-allocationRelease an allocation within an IPAM pool · --ipam-pool-id --cidr --ipam-pool-allocation-id
replace-iam-instance-profile-associationReplaces an IAM instance profile for the specified running instance · --iam-instance-profile --association-id
replace-image-criteria-in-allowed-images-settingsSets or replaces the criteria for Allowed AMIs
replace-network-acl-associationChanges which network ACL a subnet is associated with · --association-id --network-acl-id
replace-network-acl-entryReplaces an entry (rule) in a network ACL · --network-acl-id --rule-number --protocol --rule-action --egress
replace-routeReplaces an existing route within a route table in a VPC · --route-table-id
replace-route-table-associationChanges the route table associated with a given subnet, internet gateway, or virtual private gateway in a VPC · --association-id --route-table-id
replace-transit-gateway-routeReplaces the specified route in the specified transit gateway route table. · --destination-cidr-block --transit-gateway-route-table-id
replace-vpn-tunnelTrigger replacement of specified VPN tunnel. · --vpn-connection-id --vpn-tunnel-outside-ip-address
report-instance-statusSubmits feedback about the status of an instance · --instances --status --reason-codes
request-spot-fleetCreates a Spot Fleet request · --spot-fleet-request-config
request-spot-instancesCreates a Spot Instance request
reset-address-attributeResets the attribute of the specified IP address · --allocation-id --attribute
reset-ebs-default-kms-key-idResets the default KMS key for EBS encryption for your account in this Region to the Amazon Web Services managed KMS key for EBS
reset-fpga-image-attributeResets the specified attribute of the specified Amazon FPGA Image (AFI) to its default value · --fpga-image-id
reset-image-attributeResets an attribute of an AMI to its default value. · --attribute --image-id
reset-instance-attributeResets an attribute of an instance to its default value · --instance-id --attribute
reset-network-interface-attributeResets a network interface attribute · --network-interface-id
reset-snapshot-attributeResets permission settings for the specified snapshot · --attribute --snapshot-id
restore-address-to-classicThis action is deprecated · --public-ip
restore-image-from-recycle-binRestores an AMI from the Recycle Bin · --image-id
restore-managed-prefix-list-versionRestores the entries from a previous version of a managed prefix list to a new version of the prefix list. · --prefix-list-id --previous-version --current-version
restore-snapshot-from-recycle-binRestores a snapshot from the Recycle Bin · --snapshot-id
restore-snapshot-tierRestores an archived Amazon EBS snapshot for use temporarily or permanently, or modifies the restore period or restore type for a snapshot that was previously temporarily · --snapshot-id
restore-volume-from-recycle-binRestores a volume from the Recycle Bin · --volume-id
revoke-client-vpn-ingressRemoves an ingress authorization rule from a Client VPN endpoint. · --client-vpn-endpoint-id --target-network-cidr
revoke-security-group-egressRemoves the specified outbound (egress) rules from the specified security group · --group-id
revoke-security-group-ingressRemoves the specified inbound (ingress) rules from a security group
run-instancesLaunches the specified number of instances using an AMI for which you have permissions · --max-count --min-count
run-scheduled-instancesLaunches the specified Scheduled Instances · --launch-specification --scheduled-instance-id
search-local-gateway-routesSearches for routes in the specified local gateway route table. · --local-gateway-route-table-id
search-transit-gateway-multicast-groupsSearches one or more transit gateway multicast groups and returns the group membership information. · --transit-gateway-multicast-domain-id
search-transit-gateway-routesSearches for routes in the specified transit gateway route table. · --transit-gateway-route-table-id --filters
send-diagnostic-interruptSends a diagnostic interrupt to the specified Amazon EC2 instance to trigger a kernel panic (on Linux instances), or a blue screen/stop error (on Windows instances) · --instance-id
start-declarative-policies-reportGenerates an account status report · --s3-bucket --target-id
start-instancesStarts an Amazon EBS-backed instance that you've previously stopped · --instance-ids
start-network-insights-access-scope-analysisStarts analyzing the specified Network Access Scope. · --network-insights-access-scope-id --client-token
start-network-insights-analysisStarts analyzing the specified path · --network-insights-path-id --client-token
start-vpc-endpoint-service-private-dns-verificationInitiates the verification process to prove that the service provider owns the private DNS name domain for the endpoint service · --service-id
stop-instancesStops an Amazon EBS-backed instance · --instance-ids
terminate-client-vpn-connectionsTerminates active Client VPN endpoint connections · --client-vpn-endpoint-id
terminate-instancesTerminates (deletes) the specified instances · --instance-ids
unassign-ipv6-addressesUnassigns the specified IPv6 addresses or Prefix Delegation prefixes from a network interface. · --network-interface-id
unassign-private-ip-addressesUnassigns the specified secondary private IP addresses or IPv4 Prefix Delegation prefixes from a network interface. · --network-interface-id
unassign-private-nat-gateway-addressUnassigns secondary private IPv4 addresses from a private NAT gateway · --nat-gateway-id --private-ip-addresses
unlock-snapshotUnlocks a snapshot that is locked in governance mode or that is locked in compliance mode but still in the cooling-off period · --snapshot-id
unmonitor-instancesDisables detailed monitoring for a running instance · --instance-ids
update-capacity-manager-organizations-accessUpdates the Organizations access setting for EC2 Capacity Manager · --organizations-access
update-interruptible-capacity-reservation-allocationModifies the number of instances allocated to an interruptible reservation, allowing you to add more capacity or reclaim capacity to your source Capacity Reservation. · --capacity-reservation-id --target-instance-count
update-security-group-rule-descriptions-egressUpdates the description of an egress (outbound) security group rule
update-security-group-rule-descriptions-ingressUpdates the description of an ingress (inbound) security group rule
withdraw-byoip-cidrStops advertising an address range that is provisioned as an address pool · --cidr

aws route53

71

Amazon Route 53 · api 2013-04-01 · 71 commands

activate-key-signing-keyActivates a key-signing key (KSK) so that it can be used for signing by DNSSEC · --hosted-zone-id --name
associate-vpc-with-hosted-zoneAssociates an Amazon VPC with a private hosted zone · --hosted-zone-id --vpc
change-cidr-collectionCreates, changes, or deletes CIDR blocks within a collection · --id --changes
change-resource-record-setsCreates, changes, or deletes a resource record set, which contains authoritative DNS information for a specified domain name or subdomain name · --hosted-zone-id --change-batch
change-tags-for-resourceAdds, edits, or deletes tags for a health check or a hosted zone · --resource-type --resource-id
create-cidr-collectionCreates a CIDR collection in the current Amazon Web Services account. · --name --caller-reference
create-health-checkCreates a new health check · --caller-reference --health-check-config
create-hosted-zoneCreates a new public or private hosted zone · --name --caller-reference
create-key-signing-keyCreates a new key-signing key (KSK) associated with a hosted zone · --caller-reference --hosted-zone-id --key-management-service-arn --name --status
create-query-logging-configCreates a configuration for DNS query logging · --hosted-zone-id --cloud-watch-logs-log-group-arn
create-reusable-delegation-setCreates a delegation set (a group of four name servers) that can be reused by multiple hosted zones that were created by the same Amazon Web Services account · --caller-reference
create-traffic-policyCreates a traffic policy, which you use to create multiple DNS resource record sets for one domain name (such as example.com) or one subdomain name (such as www.example.c · --name --document
create-traffic-policy-instanceCreates resource record sets in a specified hosted zone based on the settings in a specified traffic policy version · --hosted-zone-id --name --ttl --traffic-policy-id --traffic-policy-version
create-traffic-policy-versionCreates a new version of an existing traffic policy · --id --document
create-vpc-association-authorizationAuthorizes the Amazon Web Services account that created a specified VPC to submit an AssociateVPCWithHostedZone request to associate the VPC with a specified hosted zone · --hosted-zone-id --vpc
deactivate-key-signing-keyDeactivates a key-signing key (KSK) so that it will not be used for signing by DNSSEC · --hosted-zone-id --name
delete-cidr-collectionDeletes a CIDR collection in the current Amazon Web Services account · --id
delete-health-checkDeletes a health check · --health-check-id
delete-hosted-zoneDeletes a hosted zone · --id
delete-key-signing-keyDeletes a key-signing key (KSK) · --hosted-zone-id --name
delete-query-logging-configDeletes a configuration for DNS query logging · --id
delete-reusable-delegation-setDeletes a reusable delegation set · --id
delete-traffic-policyDeletes a traffic policy · --id --version
delete-traffic-policy-instanceDeletes a traffic policy instance and all of the resource record sets that Amazon Route 53 created when you created the instance · --id
delete-vpc-association-authorizationRemoves authorization to submit an AssociateVPCWithHostedZone request to associate a specified VPC with a hosted zone that was created by a different account · --hosted-zone-id --vpc
disable-hosted-zone-dnssecDisables DNSSEC signing in a specific hosted zone · --hosted-zone-id
disassociate-vpc-from-hosted-zoneDisassociates an Amazon Virtual Private Cloud (Amazon VPC) from an Amazon Route 53 private hosted zone · --hosted-zone-id --vpc
enable-hosted-zone-dnssecEnables DNSSEC signing in a specific hosted zone. · --hosted-zone-id
get-account-limitGets the specified limit for the current account, for example, the maximum number of health checks that you can create using the account · --type
get-changeReturns the current status of a change batch request · --id
get-checker-ip-rangesRoute 53 does not perform authorization for this API because it retrieves information that is already available to the public
get-dnssecReturns information about DNSSEC for a specific hosted zone, including the key-signing keys (KSKs) in the hosted zone. · --hosted-zone-id
get-geo-locationGets information about whether a specified geographic location is supported for Amazon Route 53 geolocation resource record sets
get-health-checkGets information about a specified health check. · --health-check-id
get-health-check-countRetrieves the number of health checks that are associated with the current Amazon Web Services account.
get-health-check-last-failure-reasonGets the reason that a specified health check failed most recently. · --health-check-id
get-health-check-statusGets status of a specified health check · --health-check-id
get-hosted-zoneGets information about a specified hosted zone including the four name servers assigned to the hosted zone · --id
get-hosted-zone-countRetrieves the number of hosted zones that are associated with the current Amazon Web Services account.
get-hosted-zone-limitGets the specified limit for a specified hosted zone, for example, the maximum number of records that you can create in the hosted zone · --type --hosted-zone-id
get-query-logging-configGets information about a specified configuration for DNS query logging · --id
get-reusable-delegation-setRetrieves information about a specified reusable delegation set, including the four name servers that are assigned to the delegation set. · --id
get-reusable-delegation-set-limitGets the maximum number of hosted zones that you can associate with the specified reusable delegation set · --type --delegation-set-id
get-traffic-policyGets information about a specific traffic policy version · --id --version
get-traffic-policy-instanceGets information about a specified traffic policy instance · --id
get-traffic-policy-instance-countGets the number of traffic policy instances that are associated with the current Amazon Web Services account.
list-cidr-blocksReturns a paginated list of location objects and their CIDR blocks. · --collection-id
list-cidr-collectionsReturns a paginated list of CIDR collections in the Amazon Web Services account (metadata only).
list-cidr-locationsReturns a paginated list of CIDR locations for the given collection (metadata only, does not include CIDR blocks). · --collection-id
list-geo-locationsRetrieves a list of supported geographic locations
list-health-checksRetrieve a list of the health checks that are associated with the current Amazon Web Services account.
list-hosted-zonesRetrieves a list of the public and private hosted zones that are associated with the current Amazon Web Services account
list-hosted-zones-by-nameRetrieves a list of your hosted zones in lexicographic order
list-hosted-zones-by-vpcLists all the private hosted zones that a specified VPC is associated with, regardless of which Amazon Web Services account or Amazon Web Services service owns the hosted · --vpc-id --vpc-region
list-query-logging-configsLists the configurations for DNS query logging that are associated with the current Amazon Web Services account or the configuration that is associated with a specified h
list-resource-record-setsLists the resource record sets in a specified hosted zone · --hosted-zone-id
list-reusable-delegation-setsRetrieves a list of the reusable delegation sets that are associated with the current Amazon Web Services account.
list-tags-for-resourceLists tags for one health check or hosted zone · --resource-type --resource-id
list-tags-for-resourcesLists tags for up to 10 health checks or hosted zones · --resource-type --resource-ids
list-traffic-policiesGets information about the latest version for every traffic policy that is associated with the current Amazon Web Services account
list-traffic-policy-instancesGets information about the traffic policy instances that you created by using the current Amazon Web Services account
list-traffic-policy-instances-by-hosted-zoneGets information about the traffic policy instances that you created in a specified hosted zone · --hosted-zone-id
list-traffic-policy-instances-by-policyGets information about the traffic policy instances that you created by using a specify traffic policy version · --traffic-policy-id --traffic-policy-version
list-traffic-policy-versionsGets information about all of the versions for a specified traffic policy · --id
list-vpc-association-authorizationsGets a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone because you've submitted one or more CreateVPCAssociat · --hosted-zone-id
test-dns-answerGets the value that Amazon Route 53 returns in response to a DNS request for a specified record name and type · --hosted-zone-id --record-name --record-type
update-health-checkUpdates an existing health check · --health-check-id
update-hosted-zone-commentUpdates the comment for a specified hosted zone. · --id
update-hosted-zone-featuresUpdates the features configuration for a hosted zone · --hosted-zone-id
update-traffic-policy-commentUpdates the comment for a specified traffic policy version. · --id --version --comment
update-traffic-policy-instanceAfter you submit a UpdateTrafficPolicyInstance request, there's a brief delay while Route 53 creates the resource record sets that are specified in the traffic policy def · --id --ttl --traffic-policy-id --traffic-policy-version

aws acm

16

AWS Certificate Manager · api 2015-12-08 · 16 commands

add-tags-to-certificateAdds one or more tags to an ACM certificate · --certificate-arn --tags
delete-certificateDeletes a certificate and its associated private key · --certificate-arn
describe-certificateReturns detailed metadata about the specified ACM certificate · --certificate-arn
export-certificateExports a private certificate issued by a private certificate authority (CA) or public certificate for use anywhere · --certificate-arn --passphrase
get-account-configurationReturns the account configuration options associated with an Amazon Web Services account.
get-certificateRetrieves a certificate and its certificate chain · --certificate-arn
import-certificateImports a certificate into Certificate Manager (ACM) to use with services that are integrated with ACM · --certificate --private-key
list-certificatesRetrieves a list of certificate ARNs and domain names
list-tags-for-certificateLists the tags that have been applied to the ACM certificate · --certificate-arn
put-account-configurationAdds or modifies account-level configurations in ACM · --idempotency-token
remove-tags-from-certificateRemove one or more tags from an ACM certificate · --certificate-arn --tags
renew-certificateRenews an eligible ACM certificate · --certificate-arn
request-certificateRequests an ACM certificate for use with other Amazon Web Services services · --domain-name
resend-validation-emailResends the email that requests domain ownership validation · --certificate-arn --domain --validation-domain
revoke-certificateRevokes a public ACM certificate · --certificate-arn --revocation-reason
update-certificate-optionsUpdates a certificate · --certificate-arn --options

aws lambda

85

AWS Lambda · api 2015-03-31 · 85 commands

add-layer-version-permissionAdds permissions to the resource-based policy of a version of an Lambda layer · --layer-name --version-number --statement-id --action --principal
add-permissionGrants a principal permission to use a function · --function-name --statement-id --action --principal
checkpoint-durable-executionSaves the progress of a durable function execution during runtime · --durable-execution-arn --checkpoint-token
create-aliasCreates an alias for a Lambda function version · --function-name --name --function-version
create-capacity-providerCreates a capacity provider that manages compute resources for Lambda functions · --capacity-provider-name --vpc-config --permissions-config
create-code-signing-configCreates a code signing configuration · --allowed-publishers
create-event-source-mappingCreates a mapping between an event source and an Lambda function · --function-name
create-functionCreates a Lambda function · --function-name --role --code
create-function-url-configCreates a Lambda function URL with the specified configuration parameters · --function-name --auth-type
delete-aliasDeletes a Lambda function alias. · --function-name --name
delete-capacity-providerDeletes a capacity provider · --capacity-provider-name
delete-code-signing-configDeletes the code signing configuration · --code-signing-config-arn
delete-event-source-mappingDeletes an event source mapping · --uuid
delete-functionDeletes a Lambda function · --function-name
delete-function-code-signing-configRemoves the code signing configuration from the function. · --function-name
delete-function-concurrencyRemoves a concurrent execution limit from a function. · --function-name
delete-function-event-invoke-configDeletes the configuration for asynchronous invocation for a function, version, or alias · --function-name
delete-function-url-configDeletes a Lambda function URL · --function-name
delete-layer-versionDeletes a version of an Lambda layer · --layer-name --version-number
delete-provisioned-concurrency-configDeletes the provisioned concurrency configuration for a function. · --function-name --qualifier
get-account-settingsRetrieves details about your account's limits and usage in an Amazon Web Services Region.
get-aliasReturns details about a Lambda function alias. · --function-name --name
get-capacity-providerRetrieves information about a specific capacity provider, including its configuration, state, and associated resources. · --capacity-provider-name
get-code-signing-configReturns information about the specified code signing configuration. · --code-signing-config-arn
get-durable-executionRetrieves detailed information about a specific durable execution, including its current status, input payload, result or error information, and execution metadata such a · --durable-execution-arn
get-durable-execution-historyRetrieves the execution history for a durable execution, showing all the steps, callbacks, and events that occurred during the execution · --durable-execution-arn
get-durable-execution-stateRetrieves the current execution state required for the replay process during durable function execution · --durable-execution-arn --checkpoint-token
get-event-source-mappingReturns details about an event source mapping · --uuid
get-functionReturns information about the function or function version, with a link to download the deployment package that's valid for 10 minutes · --function-name
get-function-code-signing-configReturns the code signing configuration for the specified function. · --function-name
get-function-concurrencyReturns details about the reserved concurrency configuration for a function · --function-name
get-function-configurationReturns the version-specific settings of a Lambda function or version · --function-name
get-function-event-invoke-configRetrieves the configuration for asynchronous invocation for a function, version, or alias · --function-name
get-function-recursion-configReturns your function's recursive loop detection configuration. · --function-name
get-function-scaling-configRetrieves the scaling configuration for a Lambda Managed Instances function. · --function-name --qualifier
get-function-url-configReturns details about a Lambda function URL. · --function-name
get-layer-versionReturns information about a version of an Lambda layer, with a link to download the layer archive that's valid for 10 minutes. · --layer-name --version-number
get-layer-version-by-arnReturns information about a version of an Lambda layer, with a link to download the layer archive that's valid for 10 minutes. · --arn
get-layer-version-policyReturns the permission policy for a version of an Lambda layer · --layer-name --version-number
get-policyReturns the resource-based IAM policy for a function, version, or alias. · --function-name
get-provisioned-concurrency-configRetrieves the provisioned concurrency configuration for a function's alias or version. · --function-name --qualifier
get-runtime-management-configRetrieves the runtime management configuration for a function's version · --function-name
invokeInvokes a Lambda function · --function-name
invoke-asyncFor asynchronous function invocation, use Invoke · --function-name --invoke-args
invoke-with-response-streamConfigure your Lambda functions to stream response payloads back to clients · --function-name
list-aliasesReturns a list of aliases for a Lambda function. · --function-name
list-capacity-providersReturns a list of capacity providers in your account.
list-code-signing-configsReturns a list of code signing configurations
list-durable-executions-by-functionReturns a list of durable executions for a specified Lambda function · --function-name
list-event-source-mappingsLists event source mappings
list-function-event-invoke-configsRetrieves a list of configurations for asynchronous invocation for a function · --function-name
list-function-url-configsReturns a list of Lambda function URLs for the specified function. · --function-name
list-function-versions-by-capacity-providerReturns a list of function versions that are configured to use a specific capacity provider. · --capacity-provider-name
list-functionsReturns a list of Lambda functions, with the version-specific configuration of each
list-functions-by-code-signing-configList the functions that use the specified code signing configuration · --code-signing-config-arn
list-layer-versionsLists the versions of an Lambda layer · --layer-name
list-layersLists Lambda layers and shows information about the latest version of each
list-provisioned-concurrency-configsRetrieves a list of provisioned concurrency configurations for a function. · --function-name
list-tagsReturns a function, event source mapping, or code signing configuration's tags · --resource
list-versions-by-functionReturns a list of versions, with the version-specific configuration of each · --function-name
publish-layer-versionCreates an Lambda layer from a ZIP archive · --layer-name --content
publish-versionCreates a version from the current code and configuration of a function · --function-name
put-function-code-signing-configUpdate the code signing configuration for the function · --code-signing-config-arn --function-name
put-function-concurrencySets the maximum number of simultaneous executions for a function, and reserves capacity for that concurrency level · --function-name --reserved-concurrent-executions
put-function-event-invoke-configConfigures options for asynchronous invocation on a function, version, or alias · --function-name
put-function-recursion-configSets your function's recursive loop detection configuration · --function-name --recursive-loop
put-function-scaling-configSets the scaling configuration for a Lambda Managed Instances function · --function-name --qualifier
put-provisioned-concurrency-configAdds a provisioned concurrency configuration to a function's alias or version. · --function-name --qualifier --provisioned-concurrent-executions
put-runtime-management-configSets the runtime management configuration for a function's version · --function-name --update-runtime-on
remove-layer-version-permissionRemoves a statement from the permissions policy for a version of an Lambda layer · --layer-name --version-number --statement-id
remove-permissionRevokes function-use permission from an Amazon Web Services service or another Amazon Web Services account · --function-name --statement-id
send-durable-execution-callback-failureSends a failure response for a callback operation in a durable execution · --callback-id
send-durable-execution-callback-heartbeatSends a heartbeat signal for a long-running callback operation to prevent timeout · --callback-id
send-durable-execution-callback-successSends a successful completion response for a callback operation in a durable execution · --callback-id
stop-durable-executionStops a running durable execution · --durable-execution-arn
tag-resourceAdds tags to a function, event source mapping, or code signing configuration. · --resource --tags
untag-resourceRemoves tags from a function, event source mapping, or code signing configuration. · --resource --tag-keys
update-aliasUpdates the configuration of a Lambda function alias. · --function-name --name
update-capacity-providerUpdates the configuration of an existing capacity provider. · --capacity-provider-name
update-code-signing-configUpdate the code signing configuration · --code-signing-config-arn
update-event-source-mappingUpdates an event source mapping · --uuid
update-function-codeUpdates a Lambda function's code · --function-name
update-function-configurationModify the version-specific settings of a Lambda function · --function-name
update-function-event-invoke-configUpdates the configuration for asynchronous invocation for a function, version, or alias · --function-name
update-function-url-configUpdates the configuration for a Lambda function URL. · --function-name

aws logs (CloudWatch Logs)

108

Amazon CloudWatch Logs · api 2014-03-28 · 108 commands

associate-kms-keyAssociates the specified KMS key with either one log group in the account, or with all stored CloudWatch Logs query insights results in the account · --kms-key-id
associate-source-to-s3-table-integrationAssociates a data source with an S3 Table Integration for query access in the 'logs' namespace · --integration-arn --data-source
cancel-export-taskCancels the specified export task · --task-id
cancel-import-taskCancels an active import task and stops importing data from the CloudTrail Lake Event Data Store. · --import-id
create-deliveryCreates a delivery · --delivery-source-name --delivery-destination-arn
create-export-taskCreates an export task so that you can efficiently export data from a log group to an Amazon S3 bucket · --log-group-name --from --to --destination
create-import-taskStarts an import from a data source to CloudWatch Log and creates a managed log group as the destination for the imported data · --import-source-arn --import-role-arn
create-log-anomaly-detectorCreates an anomaly detector that regularly scans one or more log groups and look for patterns and anomalies in the logs · --log-group-arn-list
create-log-groupCreates a log group with the specified name · --log-group-name
create-log-streamCreates a log stream for the specified log group · --log-group-name --log-stream-name
create-scheduled-queryCreates a scheduled query that runs CloudWatch Logs Insights queries at regular intervals · --name --query-language --query-string --schedule-expression --execution-role-arn
delete-account-policyDeletes a CloudWatch Logs account policy · --policy-name --policy-type
delete-data-protection-policyDeletes the data protection policy from the specified log group · --log-group-identifier
delete-deliveryDeletes a delivery · --id
delete-delivery-destinationDeletes a delivery destination · --name
delete-delivery-destination-policyDeletes a delivery destination policy · --delivery-destination-name
delete-delivery-sourceDeletes a delivery source · --name
delete-destinationDeletes the specified destination, and eventually disables all the subscription filters that publish to it · --destination-name
delete-index-policyDeletes a log-group level field index policy that was applied to a single log group · --log-group-identifier
delete-integrationDeletes the integration between CloudWatch Logs and OpenSearch Service · --integration-name
delete-log-anomaly-detectorDeletes the specified CloudWatch Logs anomaly detector. · --anomaly-detector-arn
delete-log-groupDeletes the specified log group and permanently deletes all the archived log events associated with the log group. · --log-group-name
delete-log-streamDeletes the specified log stream and permanently deletes all the archived log events associated with the log stream. · --log-group-name --log-stream-name
delete-metric-filterDeletes the specified metric filter. · --log-group-name --filter-name
delete-query-definitionDeletes a saved CloudWatch Logs Insights query definition · --query-definition-id
delete-resource-policyDeletes a resource policy from this account
delete-retention-policyDeletes the specified retention policy · --log-group-name
delete-scheduled-queryDeletes a scheduled query and stops all future executions · --identifier
delete-subscription-filterDeletes the specified subscription filter. · --log-group-name --filter-name
delete-transformerDeletes the log transformer for the specified log group · --log-group-identifier
describe-account-policiesReturns a list of all CloudWatch Logs account policies in the account · --policy-type
describe-configuration-templatesUse this operation to return the valid and default values that are used when creating delivery sources, delivery destinations, and deliveries
describe-deliveriesRetrieves a list of the deliveries that have been created in the account
describe-delivery-destinationsRetrieves a list of the delivery destinations that have been created in the account.
describe-delivery-sourcesRetrieves a list of the delivery sources that have been created in the account.
describe-destinationsLists all your destinations
describe-export-tasksLists the specified export tasks
describe-field-indexesReturns a list of custom and default field indexes which are discovered in log data · --log-group-identifiers
describe-import-task-batchesGets detailed information about the individual batches within an import task, including their status and any error messages · --import-id
describe-import-tasksLists and describes import tasks, with optional filtering by import status and source ARN.
describe-index-policiesReturns the field index policies of the specified log group · --log-group-identifiers
describe-log-groupsReturns information about log groups, including data sources that ingest into each log group
describe-log-streamsLists the log streams for the specified log group
describe-metric-filtersLists the specified metric filters
describe-queriesReturns a list of CloudWatch Logs Insights queries that are scheduled, running, or have been run recently in this account
describe-query-definitionsThis operation returns a paginated list of your saved CloudWatch Logs Insights query definitions
describe-resource-policiesLists the resource policies in this account.
describe-subscription-filtersLists the subscription filters for the specified log group · --log-group-name
disassociate-kms-keyDisassociates the specified KMS key from the specified log group or from all CloudWatch Logs Insights query results in the account
disassociate-source-from-s3-table-integrationDisassociates a data source from an S3 Table Integration, removing query access and deleting all associated data from the integration. · --identifier
filter-log-eventsLists log events from the specified log group
get-data-protection-policyReturns information about a log group data protection policy. · --log-group-identifier
get-deliveryReturns complete information about one logical delivery · --id
get-delivery-destinationRetrieves complete information about one delivery destination. · --name
get-delivery-destination-policyRetrieves the delivery destination policy assigned to the delivery destination that you specify · --delivery-destination-name
get-delivery-sourceRetrieves complete information about one delivery source. · --name
get-integrationReturns information about one integration between CloudWatch Logs and OpenSearch Service. · --integration-name
get-log-anomaly-detectorRetrieves information about the log anomaly detector that you specify · --anomaly-detector-arn
get-log-eventsLists log events from the specified log stream · --log-stream-name
get-log-fieldsDiscovers available fields for a specific data source and type · --data-source-name --data-source-type
get-log-group-fieldsReturns a list of the fields that are included in log events in the specified log group
get-log-objectRetrieves a large logging object (LLO) and streams it back · --log-object-pointer
get-log-recordRetrieves all of the fields and values of a single log event · --log-record-pointer
get-query-resultsReturns the results from the specified query · --query-id
get-scheduled-queryRetrieves details about a specific scheduled query, including its configuration, execution status, and metadata. · --identifier
get-scheduled-query-historyRetrieves the execution history of a scheduled query within a specified time range, including query results and destination processing status. · --identifier --start-time --end-time
get-transformerReturns the information about the log transformer associated with this log group · --log-group-identifier
list-aggregate-log-group-summariesReturns an aggregate summary of all log groups in the Region grouped by specified data source characteristics · --group-by
list-anomaliesReturns a list of anomalies that log anomaly detectors have found
list-integrationsReturns a list of integrations between CloudWatch Logs and other services in this account
list-log-anomaly-detectorsRetrieves a list of the log anomaly detectors in the account.
list-log-groupsReturns a list of log groups in the Region in your account
list-log-groups-for-queryReturns a list of the log groups that were analyzed during a single CloudWatch Logs Insights query · --query-id
list-scheduled-queriesLists all scheduled queries in your account and region
list-sources-for-s3-table-integrationReturns a list of data source associations for a specified S3 Table Integration, showing which data sources are currently associated for query access. · --integration-arn
list-tags-for-resourceDisplays the tags associated with a CloudWatch Logs resource · --resource-arn
list-tags-log-groupThe ListTagsLogGroup operation is on the path to deprecation · --log-group-name
put-account-policyCreates an account-level data protection policy, subscription filter policy, field index policy, transformer policy, or metric extraction policy that applies to all log g · --policy-name --policy-document --policy-type
put-bearer-token-authenticationEnables or disables bearer token authentication for the specified log group · --log-group-identifier --bearer-token-authentication-enabled
put-data-protection-policyCreates a data protection policy for the specified log group · --log-group-identifier --policy-document
put-delivery-destinationCreates or updates a logical delivery destination · --name
put-delivery-destination-policyCreates and assigns an IAM policy that grants permissions to CloudWatch Logs to deliver logs cross-account to a specified destination in this account · --delivery-destination-name --delivery-destination-policy
put-delivery-sourceCreates or updates a logical delivery source · --name --resource-arn --log-type
put-destinationCreates or updates a destination · --destination-name --target-arn --role-arn
put-destination-policyCreates or updates an access policy associated with an existing destination · --destination-name --access-policy
put-index-policyCreates or updates a field index policy for the specified log group · --log-group-identifier --policy-document
put-integrationCreates an integration between CloudWatch Logs and another service in this account · --integration-name --resource-config --integration-type
put-log-eventsUploads a batch of log events to the specified log stream · --log-group-name --log-stream-name --log-events
put-log-group-deletion-protectionEnables or disables deletion protection for the specified log group · --log-group-identifier --deletion-protection-enabled
put-metric-filterCreates or updates a metric filter and associates it with the specified log group · --log-group-name --filter-name --filter-pattern --metric-transformations
put-query-definitionCreates or updates a query definition for CloudWatch Logs Insights · --name --query-string
put-resource-policyCreates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53
put-retention-policySets the retention of the specified log group · --log-group-name --retention-in-days
put-subscription-filterCreates or updates a subscription filter and associates it with the specified log group · --log-group-name --filter-name --filter-pattern --destination-arn
put-transformerCreates or updates a log transformer for a single log group · --log-group-identifier --transformer-config
start-live-tailStarts a Live Tail streaming session for one or more log groups · --log-group-identifiers
start-queryStarts a query of one or more log groups or data sources using CloudWatch Logs Insights · --start-time --end-time --query-string
stop-queryStops a CloudWatch Logs Insights query that is in progress · --query-id
tag-log-groupThe TagLogGroup operation is on the path to deprecation · --log-group-name --tags
tag-resourceAssigns one or more tags (key-value pairs) to the specified CloudWatch Logs resource · --resource-arn --tags
test-metric-filterTests the filter pattern of a metric filter against a sample of log event messages · --filter-pattern --log-event-messages
test-transformerUse this operation to test a log transformer · --transformer-config --log-event-messages
untag-log-groupThe UntagLogGroup operation is on the path to deprecation · --log-group-name --tags
untag-resourceRemoves one or more tags from the specified resource. · --resource-arn --tag-keys
update-anomalyUse this operation to suppress anomaly detection for a specified anomaly or pattern · --anomaly-detector-arn
update-delivery-configurationUse this operation to update the configuration of a delivery to change either the S3 path pattern or the format of the delivered logs · --id
update-log-anomaly-detectorUpdates an existing log anomaly detector. · --anomaly-detector-arn --enabled
update-scheduled-queryUpdates an existing scheduled query with new configuration · --identifier --query-language --query-string --schedule-expression --execution-role-arn

aws cloudwatch

43

Amazon CloudWatch · api 2010-08-01 · 43 commands

delete-alarm-mute-ruleDeletes a specific alarm mute rule · --alarm-mute-rule-name
delete-alarmsDeletes the specified alarms · --alarm-names
delete-anomaly-detectorDeletes the specified anomaly detection model from your account
delete-dashboardsDeletes all dashboards that you specify · --dashboard-names
delete-insight-rulesPermanently deletes the specified Contributor Insights rules · --rule-names
delete-metric-streamPermanently deletes the metric stream that you specify. · --name
describe-alarm-contributorsReturns the information of the current alarm contributors that are in ALARM state · --alarm-name
describe-alarm-historyRetrieves the history for the specified alarm
describe-alarmsRetrieves the specified alarms
describe-alarms-for-metricRetrieves the alarms for the specified metric · --metric-name --namespace
describe-anomaly-detectorsLists the anomaly detection models that you have created in your account
describe-insight-rulesReturns a list of all the Contributor Insights rules in your account
disable-alarm-actionsDisables the actions for the specified alarms · --alarm-names
disable-insight-rulesDisables the specified Contributor Insights rules · --rule-names
enable-alarm-actionsEnables the actions for the specified alarms. · --alarm-names
enable-insight-rulesEnables the specified Contributor Insights rules · --rule-names
get-alarm-mute-ruleRetrieves details for a specific alarm mute rule · --alarm-mute-rule-name
get-dashboardDisplays the details of the dashboard that you specify · --dashboard-name
get-insight-rule-reportThis operation returns the time series data collected by a Contributor Insights rule · --rule-name --start-time --end-time --period
get-metric-dataYou can use the GetMetricData API to retrieve CloudWatch metric values · --metric-data-queries --start-time --end-time
get-metric-statisticsGets statistics for the specified metric · --namespace --metric-name --start-time --end-time --period
get-metric-streamReturns information about the metric stream that you specify. · --name
get-metric-widget-imageYou can use the GetMetricWidgetImage API to retrieve a snapshot graph of one or more Amazon CloudWatch metrics as a bitmap image · --metric-widget
list-alarm-mute-rulesLists alarm mute rules in your Amazon Web Services account and region
list-dashboardsReturns a list of the dashboards for your account
list-managed-insight-rulesReturns a list that contains the number of managed Contributor Insights rules in your account. · --resource-arn
list-metric-streamsReturns a list of metric streams in this account.
list-metricsList the specified metrics
list-tags-for-resourceDisplays the tags associated with a CloudWatch resource · --resource-arn
put-alarm-mute-ruleCreates or updates an alarm mute rule · --name --rule
put-anomaly-detectorCreates an anomaly detection model for a CloudWatch metric
put-composite-alarmCreates or updates a composite alarm · --alarm-name --alarm-rule
put-dashboardCreates a dashboard if it does not already exist, or updates an existing dashboard · --dashboard-name --dashboard-body
put-insight-ruleCreates a Contributor Insights rule · --rule-name --rule-definition
put-managed-insight-rulesCreates a managed Contributor Insights rule for a specified Amazon Web Services resource · --managed-rules
put-metric-alarmCreates or updates an alarm and associates it with the specified metric, metric math expression, anomaly detection model, or Metrics Insights query · --alarm-name --evaluation-periods --comparison-operator
put-metric-dataPublishes metric data to Amazon CloudWatch · --namespace
put-metric-streamCreates or updates a metric stream · --name --firehose-arn --role-arn --output-format
set-alarm-stateTemporarily sets the state of an alarm for testing purposes · --alarm-name --state-value --state-reason
start-metric-streamsStarts the streaming of metrics for one or more of your metric streams. · --names
stop-metric-streamsStops the streaming of metrics for one or more of your metric streams. · --names
tag-resourceAssigns one or more tags (key-value pairs) to the specified CloudWatch resource · --resource-arn --tags
untag-resourceRemoves one or more tags from the specified resource. · --resource-arn --tag-keys

aws events (EventBridge)

57

Amazon EventBridge · api 2015-10-07 · 57 commands

activate-event-sourceActivates a partner event source that has been deactivated · --name
cancel-replayCancels the specified replay. · --replay-name
create-api-destinationCreates an API destination, which is an HTTP invocation endpoint configured as a target for events · --name --connection-arn --invocation-endpoint --http-method
create-archiveCreates an archive of events with the specified settings · --archive-name --event-source-arn
create-connectionCreates a connection · --name --authorization-type --auth-parameters
create-endpointCreates a global endpoint · --name --routing-config --event-buses
create-event-busCreates a new event bus within your account · --name
create-partner-event-sourceCalled by an SaaS partner to create a partner event source · --name --account
deactivate-event-sourceYou can use this operation to temporarily stop receiving events from the specified partner event source · --name
deauthorize-connectionRemoves all authorization parameters from the connection · --name
delete-api-destinationDeletes the specified API destination. · --name
delete-archiveDeletes the specified archive. · --archive-name
delete-connectionDeletes a connection. · --name
delete-endpointDelete an existing global endpoint · --name
delete-event-busDeletes the specified custom event bus or partner event bus · --name
delete-partner-event-sourceThis operation is used by SaaS partners to delete a partner event source · --name --account
delete-ruleDeletes the specified rule · --name
describe-api-destinationRetrieves details about an API destination. · --name
describe-archiveRetrieves details about an archive. · --archive-name
describe-connectionRetrieves details about a connection. · --name
describe-endpointGet the information about an existing global endpoint · --name
describe-event-busDisplays details about an event bus in your account
describe-event-sourceThis operation lists details about a partner event source that is shared with your account. · --name
describe-partner-event-sourceAn SaaS partner can use this operation to list details about a partner event source that they have created · --name
describe-replayRetrieves details about a replay · --replay-name
describe-ruleDescribes the specified rule · --name
disable-ruleDisables the specified rule · --name
enable-ruleEnables the specified rule · --name
list-api-destinationsRetrieves a list of API destination in the account in the current Region.
list-archivesLists your archives
list-connectionsRetrieves a list of connections from the account.
list-endpointsList the global endpoints associated with this account
list-event-busesLists all the event buses in your account, including the default event bus, custom event buses, and partner event buses.
list-event-sourcesYou can use this to see all the partner event sources that have been shared with your Amazon Web Services account
list-partner-event-source-accountsAn SaaS partner can use this operation to display the Amazon Web Services account ID that a particular partner event source name is associated with · --event-source-name
list-partner-event-sourcesAn SaaS partner can use this operation to list all the partner event source names that they have created · --name-prefix
list-replaysLists your replays
list-rule-names-by-targetLists the rules for the specified target · --target-arn
list-rulesLists your Amazon EventBridge rules
list-tags-for-resourceDisplays the tags associated with an EventBridge resource · --resource-arn
list-targets-by-ruleLists the targets assigned to the specified rule · --rule
put-eventsSends custom events to Amazon EventBridge so that they can be matched to rules · --entries
put-partner-eventsThis is used by SaaS partners to write events to a customer's partner event bus · --entries
put-permissionRunning PutPermission permits the specified Amazon Web Services account or Amazon Web Services organization to put events to the specified event bus
put-ruleCreates or updates the specified rule · --name
put-targetsAdds the specified targets to the specified rule, or updates the targets if they are already associated with the rule · --rule --targets
remove-permissionRevokes the permission of another Amazon Web Services account to be able to put events to the specified event bus
remove-targetsRemoves the specified targets from the specified rule · --rule --ids
start-replayStarts the specified replay · --replay-name --event-source-arn --event-start-time --event-end-time --destination
tag-resourceAssigns one or more tags (key-value pairs) to the specified EventBridge resource · --resource-arn --tags
test-event-patternTests whether the specified event pattern matches the provided event · --event-pattern --event
untag-resourceRemoves one or more tags from the specified EventBridge resource · --resource-arn --tag-keys
update-api-destinationUpdates an API destination. · --name
update-archiveUpdates the specified archive. · --archive-name
update-connectionUpdates settings for a connection. · --name
update-endpointUpdate an existing endpoint · --name
update-event-busUpdates the specified event bus.

aws ssm (Systems Manager)

146

Amazon Simple Systems Manager (SSM) · api 2014-11-06 · 146 commands

add-tags-to-resourceAdds or overwrites one or more tags for the specified resource · --resource-type --resource-id --tags
associate-ops-item-related-itemAssociates a related item to a Systems Manager OpsCenter OpsItem · --ops-item-id --association-type --resource-type --resource-uri
cancel-commandAttempts to cancel the command specified by the Command ID · --command-id
cancel-maintenance-window-executionStops a maintenance window execution that is already in progress and cancels any tasks in the window that haven't already starting running · --window-execution-id
create-activationGenerates an activation code and activation ID you can use to register your on-premises servers, edge devices, or virtual machine (VM) with Amazon Web Services Systems Ma · --iam-role
create-associationA State Manager association defines the state that you want to maintain on your managed nodes · --name
create-association-batchAssociates the specified Amazon Web Services Systems Manager document (SSM document) with the specified managed nodes or targets · --entries
create-documentCreates a Amazon Web Services Systems Manager (SSM document) · --content --name
create-maintenance-windowCreates a new maintenance window · --name --schedule --duration --cutoff --allow-unassociated-targets
create-ops-itemCreates a new OpsItem · --description --source --title
create-ops-metadataIf you create a new application in Application Manager, Amazon Web Services Systems Manager calls this API operation to specify information about the new application, inc · --resource-id
create-patch-baselineCreates a patch baseline · --name
create-resource-data-syncA resource data sync helps you view data from multiple sources in a single location · --sync-name
delete-activationDeletes an activation · --activation-id
delete-associationDisassociates the specified Amazon Web Services Systems Manager document (SSM document) from the specified managed node
delete-documentDeletes the Amazon Web Services Systems Manager document (SSM document) and all managed node associations to the document · --name
delete-inventoryDelete a custom inventory type or the data associated with a custom Inventory type · --type-name
delete-maintenance-windowDeletes a maintenance window. · --window-id
delete-ops-itemDelete an OpsItem · --ops-item-id
delete-ops-metadataDelete OpsMetadata related to an application. · --ops-metadata-arn
delete-parameterDelete a parameter from the system · --name
delete-parametersDelete a list of parameters · --names
delete-patch-baselineDeletes a patch baseline. · --baseline-id
delete-resource-data-syncDeletes a resource data sync configuration · --sync-name
delete-resource-policyDeletes a Systems Manager resource policy · --resource-arn --policy-id --policy-hash
deregister-managed-instanceRemoves the server or virtual machine from the list of registered servers · --instance-id
deregister-patch-baseline-for-patch-groupRemoves a patch group from a patch baseline. · --baseline-id --patch-group
deregister-target-from-maintenance-windowRemoves a target from a maintenance window. · --window-id --window-target-id
deregister-task-from-maintenance-windowRemoves a task from a maintenance window. · --window-id --window-task-id
describe-activationsDescribes details about the activation, such as the date and time the activation was created, its expiration date, the Identity and Access Management (IAM) role assigned
describe-associationDescribes the association for the specified target or managed node
describe-association-execution-targetsViews information about a specific execution of a specific association. · --association-id --execution-id
describe-association-executionsViews all executions for a specific association ID. · --association-id
describe-automation-executionsProvides details about all active and terminated Automation executions.
describe-automation-step-executionsInformation about all active and terminated step executions in an Automation workflow. · --automation-execution-id
describe-available-patchesLists all patches eligible to be included in a patch baseline
describe-documentDescribes the specified Amazon Web Services Systems Manager document (SSM document). · --name
describe-document-permissionDescribes the permissions for a Amazon Web Services Systems Manager document (SSM document) · --name --permission-type
describe-effective-instance-associationsAll associations for the managed nodes. · --instance-id
describe-effective-patches-for-patch-baselineRetrieves the current effective patches (the patch and the approval state) for the specified patch baseline · --baseline-id
describe-instance-associations-statusThe status of the associations for the managed nodes. · --instance-id
describe-instance-informationProvides information about one or more of your managed nodes, including the operating system platform, SSM Agent version, association status, and IP address
describe-instance-patch-statesRetrieves the high-level patch state of one or more managed nodes. · --instance-ids
describe-instance-patch-states-for-patch-groupRetrieves the high-level patch state for the managed nodes in the specified patch group. · --patch-group
describe-instance-patchesRetrieves information about the patches on the specified managed node and their state relative to the patch baseline being used for the node. · --instance-id
describe-instance-propertiesAn API operation used by the Systems Manager console to display information about Systems Manager managed nodes.
describe-inventory-deletionsDescribes a specific delete inventory operation.
describe-maintenance-window-execution-task-invocationsRetrieves the individual task executions (one per target) for a particular task run as part of a maintenance window execution. · --window-execution-id --task-id
describe-maintenance-window-execution-tasksFor a given maintenance window execution, lists the tasks that were run. · --window-execution-id
describe-maintenance-window-executionsLists the executions of a maintenance window · --window-id
describe-maintenance-window-scheduleRetrieves information about upcoming executions of a maintenance window.
describe-maintenance-window-targetsLists the targets registered with the maintenance window. · --window-id
describe-maintenance-window-tasksLists the tasks in a maintenance window · --window-id
describe-maintenance-windowsRetrieves the maintenance windows in an Amazon Web Services account.
describe-maintenance-windows-for-targetRetrieves information about the maintenance window targets or tasks that a managed node is associated with. · --targets --resource-type
describe-ops-itemsQuery a set of OpsItems
describe-parametersLists the parameters in your Amazon Web Services account or the parameters shared with you when you enable the Shared option
describe-patch-baselinesLists the patch baselines in your Amazon Web Services account.
describe-patch-group-stateReturns high-level aggregated patch compliance state information for a patch group. · --patch-group
describe-patch-groupsLists all patch groups that have been registered with patch baselines.
describe-patch-propertiesLists the properties of available patches organized by product, product family, classification, severity, and other properties of available patches · --operating-system --property
describe-sessionsRetrieves a list of all active sessions (both connected and disconnected) or terminated sessions from the past 30 days. · --state
disassociate-ops-item-related-itemDeletes the association between an OpsItem and a related item · --ops-item-id --association-id
get-access-tokenReturns a credentials set to be used with just-in-time node access. · --access-request-id
get-automation-executionGet detailed information about a particular Automation execution. · --automation-execution-id
get-calendar-stateGets the state of a Amazon Web Services Systems Manager change calendar at the current time or a specified time · --calendar-names
get-command-invocationReturns detailed information about command execution for an invocation or plugin · --command-id --instance-id
get-connection-statusRetrieves the Session Manager connection status for a managed node to determine whether it is running and ready to receive Session Manager connections. · --target
get-default-patch-baselineRetrieves the default patch baseline
get-deployable-patch-snapshot-for-instanceRetrieves the current snapshot for the patch baseline the managed node uses · --instance-id --snapshot-id
get-documentGets the contents of the specified Amazon Web Services Systems Manager document (SSM document). · --name
get-execution-previewInitiates the process of retrieving an existing preview that shows the effects that running a specified Automation runbook would have on the targeted resources. · --execution-preview-id
get-inventoryQuery inventory information
get-inventory-schemaReturn a list of inventory type names for the account, or return a list of attribute names for a specific Inventory item type.
get-maintenance-windowRetrieves a maintenance window. · --window-id
get-maintenance-window-executionRetrieves details about a specific a maintenance window execution. · --window-execution-id
get-maintenance-window-execution-taskRetrieves the details about a specific task run as part of a maintenance window execution. · --window-execution-id --task-id
get-maintenance-window-execution-task-invocationRetrieves information about a specific task running on a specific target. · --window-execution-id --task-id --invocation-id
get-maintenance-window-taskRetrieves the details of a maintenance window task · --window-id --window-task-id
get-ops-itemGet information about an OpsItem by using the ID · --ops-item-id
get-ops-metadataView operational metadata related to an application in Application Manager. · --ops-metadata-arn
get-ops-summaryView a summary of operations metadata (OpsData) based on specified filters and aggregators
get-parameterGet information about a single parameter by specifying the parameter name · --name
get-parameter-historyRetrieves the history of all changes to a parameter · --name
get-parametersGet information about one or more parameters by specifying multiple parameter names · --names
get-parameters-by-pathRetrieve information about one or more parameters under a specified level in a hierarchy · --path
get-patch-baselineRetrieves information about a patch baseline. · --baseline-id
get-patch-baseline-for-patch-groupRetrieves the patch baseline that should be used for the specified patch group. · --patch-group
get-resource-policiesReturns an array of the Policy object. · --resource-arn
get-service-settingServiceSetting is an account-level setting for an Amazon Web Services service · --setting-id
label-parameter-versionA parameter label is a user-defined alias to help you manage different versions of a parameter · --name --labels
list-association-versionsRetrieves all versions of an association for a specific association ID. · --association-id
list-associationsReturns all State Manager associations in the current Amazon Web Services account and Amazon Web Services Region
list-command-invocationsAn invocation is copy of a command sent to a specific managed node
list-commandsLists the commands requested by users of the Amazon Web Services account.
list-compliance-itemsFor a specified resource ID, this API operation returns a list of compliance statuses for different resource types
list-compliance-summariesReturns a summary count of compliant and non-compliant resources for a compliance type
list-document-metadata-historyAmazon Web Services Systems Manager Change Manager is no longer open to new customers · --name --metadata
list-document-versionsList all versions for a document. · --name
list-documentsReturns all Systems Manager (SSM) documents in the current Amazon Web Services account and Amazon Web Services Region
list-inventory-entriesA list of inventory items returned by the request. · --instance-id --type-name
list-nodesTakes in filters and returns a list of managed nodes matching the filter criteria.
list-nodes-summaryGenerates a summary of managed instance/node metadata based on the filters and aggregators you specify · --aggregators
list-ops-item-eventsReturns a list of all OpsItem events in the current Amazon Web Services Region and Amazon Web Services account
list-ops-item-related-itemsLists all related-item resources associated with a Systems Manager OpsCenter OpsItem
list-ops-metadataAmazon Web Services Systems Manager calls this API operation when displaying all Application Manager OpsMetadata objects or blobs.
list-resource-compliance-summariesReturns a resource-level summary count
list-resource-data-syncLists your resource data sync configurations
list-tags-for-resourceReturns a list of the tags assigned to the specified resource · --resource-type --resource-id
modify-document-permissionShares a Amazon Web Services Systems Manager document (SSM document)publicly or privately · --name --permission-type
put-compliance-itemsRegisters a compliance type and other compliance details on a designated resource · --resource-id --resource-type --compliance-type --execution-summary --items
put-inventoryBulk update custom inventory items on one or more managed nodes · --instance-id --items
put-parameterCreate or update a parameter in Parameter Store. · --name --value
put-resource-policyCreates or updates a Systems Manager resource policy · --resource-arn --policy
register-default-patch-baselineDefines the default patch baseline for the relevant operating system · --baseline-id
register-patch-baseline-for-patch-groupRegisters a patch baseline for a patch group. · --baseline-id --patch-group
register-target-with-maintenance-windowRegisters a target with a maintenance window. · --window-id --resource-type --targets
register-task-with-maintenance-windowAdds a new task to a maintenance window. · --window-id --task-arn --task-type
remove-tags-from-resourceRemoves tag keys from the specified resource. · --resource-type --resource-id --tag-keys
reset-service-settingServiceSetting is an account-level setting for an Amazon Web Services service · --setting-id
resume-sessionReconnects a session to a managed node after it has been disconnected · --session-id
send-automation-signalSends a signal to an Automation execution to change the current behavior or status of the execution. · --automation-execution-id --signal-type
send-commandRuns commands on one or more managed nodes. · --document-name
start-access-requestStarts the workflow for just-in-time node access sessions. · --reason --targets
start-associations-onceRuns an association immediately and only one time · --association-ids
start-automation-executionInitiates execution of an Automation runbook. · --document-name
start-change-request-executionAmazon Web Services Systems Manager Change Manager is no longer open to new customers · --document-name --runbooks
start-execution-previewInitiates the process of creating a preview showing the effects that running a specified Automation runbook would have on the targeted resources. · --document-name
start-sessionInitiates a connection to a target (for example, a managed node) for a Session Manager session · --target
stop-automation-executionStop an Automation that is currently running. · --automation-execution-id
terminate-sessionPermanently ends a session and closes the data connection between the Session Manager client and SSM Agent on the managed node · --session-id
unlabel-parameter-versionRemove a label or labels from a parameter · --name --parameter-version --labels
update-associationUpdates an association · --association-id
update-association-statusUpdates the status of the Amazon Web Services Systems Manager document (SSM document) associated with the specified managed node · --name --instance-id --association-status
update-documentUpdates one or more values for an SSM document. · --content --name
update-document-default-versionSet the default version of a document · --name --document-version
update-document-metadataAmazon Web Services Systems Manager Change Manager is no longer open to new customers · --name --document-reviews
update-maintenance-windowUpdates an existing maintenance window · --window-id
update-maintenance-window-targetModifies the target of an existing maintenance window · --window-id --window-target-id
update-maintenance-window-taskModifies a task assigned to a maintenance window · --window-id --window-task-id
update-managed-instance-roleChanges the Identity and Access Management (IAM) role that is assigned to the on-premises server, edge device, or virtual machines (VM) · --instance-id --iam-role
update-ops-itemEdit or change an OpsItem · --ops-item-id
update-ops-metadataAmazon Web Services Systems Manager calls this API operation when you edit OpsMetadata in Application Manager. · --ops-metadata-arn
update-patch-baselineModifies an existing patch baseline · --baseline-id
update-resource-data-syncUpdate a resource data sync · --sync-name --sync-type --sync-source
update-service-settingServiceSetting is an account-level setting for an Amazon Web Services service · --setting-id --setting-value

aws secretsmanager

23

AWS Secrets Manager · api 2017-10-17 · 23 commands

batch-get-secret-valueRetrieves the contents of the encrypted fields SecretString or SecretBinary for up to 20 secrets
cancel-rotate-secretTurns off automatic rotation, and if a rotation is currently in progress, cancels the rotation · --secret-id
create-secretCreates a new secret · --name
delete-resource-policyDeletes the resource-based permission policy attached to the secret · --secret-id
delete-secretDeletes a secret and all of its versions · --secret-id
describe-secretRetrieves the details of a secret · --secret-id
get-random-passwordGenerates a random password
get-resource-policyRetrieves the JSON text of the resource-based policy document attached to the secret · --secret-id
get-secret-valueRetrieves the contents of the encrypted fields SecretString or SecretBinary from the specified version of a secret, whichever contains content · --secret-id
list-secret-version-idsLists the versions of a secret · --secret-id
list-secretsLists the secrets that are stored by Secrets Manager in the Amazon Web Services account, not including secrets that are marked for deletion
put-resource-policyAttaches a resource-based permission policy to a secret · --secret-id --resource-policy
put-secret-valueCreates a new version of your secret by creating a new encrypted value and attaching it to the secret · --secret-id
remove-regions-from-replicationFor a secret that is replicated to other Regions, deletes the secret replicas from the Regions you specify · --secret-id --remove-replica-regions
replicate-secret-to-regionsReplicates the secret to a new Regions · --secret-id --add-replica-regions
restore-secretCancels the scheduled deletion of a secret by removing the DeletedDate time stamp · --secret-id
rotate-secretConfigures and starts the asynchronous process of rotating the secret · --secret-id
stop-replication-to-replicaRemoves the link between the replica secret and the primary secret and promotes the replica to a primary secret in the replica Region · --secret-id
tag-resourceAttaches tags to a secret · --secret-id --tags
untag-resourceRemoves specific tags from a secret · --secret-id --tag-keys
update-secretModifies the details of a secret, including metadata and the secret value · --secret-id
update-secret-version-stageModifies the staging labels attached to a version of a secret · --secret-id --version-stage
validate-resource-policyValidates that a resource policy does not grant a wide range of principals access to your secret · --resource-policy

aws kms

53

AWS Key Management Service · api 2014-11-01 · 53 commands

cancel-key-deletionCancels the deletion of a KMS key · --key-id
connect-custom-key-storeConnects or reconnects a custom key store to its backing key store · --custom-key-store-id
create-aliasCreates a friendly name for a KMS key · --alias-name --target-key-id
create-custom-key-storeCreates a custom key store backed by a key store that you own and manage · --custom-key-store-name
create-grantAdds a grant to a KMS key · --key-id --grantee-principal --operations
create-keyCreates a unique customer managed KMS key in your Amazon Web Services account and Region
decryptDecrypts ciphertext that was encrypted by a KMS key using any of the following operations: Encrypt GenerateDataKey GenerateDataKeyPair GenerateDataKeyWithoutPlaintext Gen
delete-aliasDeletes the specified alias · --alias-name
delete-custom-key-storeDeletes a custom key store · --custom-key-store-id
delete-imported-key-materialDeletes key material that was previously imported · --key-id
derive-shared-secretDerives a shared secret using a key agreement algorithm · --key-id --key-agreement-algorithm --public-key
describe-custom-key-storesGets information about custom key stores in the account and Region
describe-keyProvides detailed information about a KMS key · --key-id
disable-keySets the state of a KMS key to disabled · --key-id
disable-key-rotationDisables automatic rotation of the key material of the specified symmetric encryption KMS key · --key-id
disconnect-custom-key-storeDisconnects the custom key store from its backing key store · --custom-key-store-id
enable-keySets the key state of a KMS key to enabled · --key-id
enable-key-rotationEnables automatic rotation of the key material of the specified symmetric encryption KMS key · --key-id
encryptEncrypts plaintext of up to 4,096 bytes using a KMS key · --key-id --plaintext
generate-data-keyReturns a unique symmetric data key for use outside of KMS · --key-id
generate-data-key-pairReturns a unique asymmetric data key pair for use outside of KMS · --key-id --key-pair-spec
generate-data-key-pair-without-plaintextReturns a unique asymmetric data key pair for use outside of KMS · --key-id --key-pair-spec
generate-data-key-without-plaintextReturns a unique symmetric data key for use outside of KMS · --key-id
generate-macGenerates a hash-based message authentication code (HMAC) for a message using an HMAC KMS key and a MAC algorithm that the key supports · --message --key-id --mac-algorithm
generate-randomReturns a random byte string that is cryptographically secure
get-key-policyGets a key policy attached to the specified KMS key · --key-id
get-key-rotation-statusProvides detailed information about the rotation status for a KMS key, including whether automatic rotation of the key material is enabled for the specified KMS key, the · --key-id
get-parameters-for-importReturns the public key and an import token you need to import or reimport key material for a KMS key · --key-id --wrapping-algorithm --wrapping-key-spec
get-public-keyReturns the public key of an asymmetric KMS key · --key-id
import-key-materialImports or reimports key material into an existing KMS key that was created without key material · --key-id --import-token --encrypted-key-material
list-aliasesGets a list of aliases in the caller's Amazon Web Services account and region
list-grantsGets a list of all grants for the specified KMS key · --key-id
list-key-policiesGets the names of the key policies that are attached to a KMS key · --key-id
list-key-rotationsReturns information about the key materials associated with the specified KMS key · --key-id
list-keysGets a list of all KMS keys in the caller's Amazon Web Services account and Region
list-resource-tagsReturns all tags on the specified KMS key · --key-id
list-retirable-grantsReturns information about all grants in the Amazon Web Services account and Region that have the specified retiring principal · --retiring-principal
put-key-policyAttaches a key policy to the specified KMS key · --key-id --policy
re-encryptDecrypts ciphertext and then reencrypts it entirely within KMS · --destination-key-id
replicate-keyReplicates a multi-Region key into the specified Region · --key-id --replica-region
retire-grantDeletes a grant
revoke-grantDeletes the specified grant · --key-id --grant-id
rotate-key-on-demandImmediately initiates rotation of the key material of the specified symmetric encryption KMS key · --key-id
schedule-key-deletionSchedules the deletion of a KMS key · --key-id
signCreates a digital signature for a message or message digest by using the private key in an asymmetric signing KMS key · --key-id --message --signing-algorithm
tag-resourceAdds or edits tags on a customer managed key · --key-id --tags
untag-resourceDeletes tags from a customer managed key · --key-id --tag-keys
update-aliasAssociates an existing KMS alias with a different KMS key · --alias-name --target-key-id
update-custom-key-storeChanges the properties of a custom key store · --custom-key-store-id
update-key-descriptionUpdates the description of a KMS key · --key-id --description
update-primary-regionChanges the primary key of a multi-Region key · --key-id --primary-region
verifyVerifies a digital signature that was generated by the Sign operation · --key-id --message --signature --signing-algorithm
verify-macVerifies the hash-based message authentication code (HMAC) for a specified message, HMAC KMS key, and MAC algorithm · --message --key-id --mac-algorithm --mac

aws dynamodb

57

Amazon DynamoDB · api 2012-08-10 · 57 commands

batch-execute-statementThis operation allows you to perform batch reads or writes on data stored in DynamoDB, using PartiQL · --statements
batch-get-itemThe BatchGetItem operation returns the attributes of one or more items from one or more tables · --request-items
batch-write-itemThe BatchWriteItem operation puts or deletes multiple items in one or more tables · --request-items
create-backupCreates a backup for an existing table · --table-name --backup-name
create-global-tableCreates a global table from an existing table · --global-table-name --replication-group
create-tableThe CreateTable operation adds a new table to your account · --table-name
delete-backupDeletes an existing backup of a table · --backup-arn
delete-itemDeletes a single item in a table by primary key · --table-name --key
delete-resource-policyDeletes the resource-based policy attached to the resource, which can be a table or stream · --resource-arn
delete-tableThe DeleteTable operation deletes a table and all of its items · --table-name
describe-backupDescribes an existing backup of a table · --backup-arn
describe-continuous-backupsChecks the status of continuous backups and point in time recovery on the specified table · --table-name
describe-contributor-insightsReturns information about contributor insights for a given table or global secondary index. · --table-name
describe-endpointsReturns the regional endpoint information
describe-exportDescribes an existing table export. · --export-arn
describe-global-tableReturns information about the specified global table · --global-table-name
describe-global-table-settingsDescribes Region-specific settings for a global table · --global-table-name
describe-importRepresents the properties of the import. · --import-arn
describe-kinesis-streaming-destinationReturns information about the status of Kinesis streaming. · --table-name
describe-limitsReturns the current provisioned-capacity quotas for your Amazon Web Services account in a Region, both for the Region as a whole and for any one DynamoDB table that you c
describe-tableReturns information about the table, including the current status of the table, when it was created, the primary key schema, and any indexes on the table · --table-name
describe-table-replica-auto-scalingDescribes auto scaling settings across replicas of the global table at once. · --table-name
describe-time-to-liveGives a description of the Time to Live (TTL) status on the specified table. · --table-name
disable-kinesis-streaming-destinationStops replication from the DynamoDB table to the Kinesis data stream · --table-name --stream-arn
enable-kinesis-streaming-destinationStarts table data replication to the specified Kinesis data stream at a timestamp chosen during the enable workflow · --table-name --stream-arn
execute-statementThis operation allows you to perform reads and singleton writes on data stored in DynamoDB, using PartiQL · --statement
execute-transactionThis operation allows you to perform transactional reads or writes on data stored in DynamoDB, using PartiQL · --transact-statements
export-table-to-point-in-timeExports table data to an S3 bucket · --table-arn --s3-bucket
get-itemThe GetItem operation returns a set of attributes for the item with the given primary key · --table-name --key
get-resource-policyReturns the resource-based policy document attached to the resource, which can be a table or stream, in JSON format · --resource-arn
import-tableImports table data from an S3 bucket. · --s3-bucket-source --input-format --table-creation-parameters
list-backupsList DynamoDB backups that are associated with an Amazon Web Services account and weren't made with Amazon Web Services Backup
list-contributor-insightsReturns a list of ContributorInsightsSummary for a table and all its global secondary indexes.
list-exportsLists completed exports within the past 90 days, in reverse alphanumeric order of ExportArn.
list-global-tablesLists all global tables that have a replica in the specified Region
list-importsLists completed imports within the past 90 days.
list-tablesReturns an array of table names associated with the current account and endpoint
list-tags-of-resourceList all tags on an Amazon DynamoDB resource · --resource-arn
put-itemCreates a new item, or replaces an old item with a new item · --table-name --item
put-resource-policyAttaches a resource-based policy document to the resource, which can be a table or stream · --resource-arn --policy
queryYou must provide the name of the partition key attribute and a single value for that attribute · --table-name
restore-table-from-backupCreates a new table from an existing backup · --target-table-name --backup-arn
restore-table-to-point-in-timeRestores the specified table to the specified point in time within EarliestRestorableDateTime and LatestRestorableDateTime · --target-table-name
scanThe Scan operation returns one or more items and item attributes by accessing every item in a table or a secondary index · --table-name
tag-resourceAssociate a set of tags with an Amazon DynamoDB resource · --resource-arn --tags
transact-get-itemsTransactGetItems is a synchronous operation that atomically retrieves multiple items from one or more tables (but not from indexes) in a single account and Region · --transact-items
transact-write-itemsTransactWriteItems is a synchronous write operation that groups up to 100 action requests · --transact-items
untag-resourceRemoves the association of tags from an Amazon DynamoDB resource · --resource-arn --tag-keys
update-continuous-backupsUpdateContinuousBackups enables or disables point in time recovery for the specified table · --table-name --point-in-time-recovery-specification
update-contributor-insightsUpdates the status for contributor insights for a specific table or index · --table-name --contributor-insights-action
update-global-tableAdds or removes replicas in the specified global table · --global-table-name --replica-updates
update-global-table-settingsUpdates settings for a global table · --global-table-name
update-itemEdits an existing item's attributes, or adds a new item to the table if it does not already exist · --table-name --key
update-kinesis-streaming-destinationThe command to update the Kinesis stream destination. · --table-name --stream-arn
update-tableModifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table · --table-name
update-table-replica-auto-scalingUpdates auto scaling settings on your global tables at once. · --table-name
update-time-to-liveThe UpdateTimeToLive method enables or disables Time to Live (TTL) for the specified table · --table-name --time-to-live-specification

aws sns

42

Amazon Simple Notification Service · api 2010-03-31 · 42 commands

add-permissionAdds a statement to a topic's access control policy, granting access for the specified Amazon Web Services accounts to the specified actions · --topic-arn --label --aws-account-id --action-name
check-if-phone-number-is-opted-outAccepts a phone number and indicates whether the phone holder has opted out of receiving SMS messages from your Amazon Web Services account · --phone-number
confirm-subscriptionVerifies an endpoint owner's intent to receive messages by validating the token sent to the endpoint by an earlier Subscribe action · --topic-arn --token
create-platform-applicationCreates a platform application object for one of the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging), to which devices and mobile ap · --name --platform --attributes
create-platform-endpointCreates an endpoint for a device and mobile app on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS · --platform-application-arn --token
create-sms-sandbox-phone-numberAdds a destination phone number to an Amazon Web Services account in the SMS sandbox and sends a one-time password (OTP) to that phone number · --phone-number
create-topicCreates a topic to which notifications can be published · --name
delete-endpointDeletes the endpoint for a device and mobile app from Amazon SNS · --endpoint-arn
delete-platform-applicationDeletes a platform application object for one of the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging) · --platform-application-arn
delete-sms-sandbox-phone-numberDeletes an Amazon Web Services account's verified or pending phone number from the SMS sandbox · --phone-number
delete-topicDeletes a topic and all its subscriptions · --topic-arn
get-data-protection-policyRetrieves the specified inline DataProtectionPolicy document that is stored in the specified Amazon SNS topic. · --resource-arn
get-endpoint-attributesRetrieves the endpoint attributes for a device on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS · --endpoint-arn
get-platform-application-attributesRetrieves the attributes of the platform application object for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging) · --platform-application-arn
get-sms-attributesReturns the settings for sending SMS messages from your Amazon Web Services account
get-sms-sandbox-account-statusRetrieves the SMS sandbox status for the calling Amazon Web Services account in the target Amazon Web Services Region
get-subscription-attributesReturns all of the properties of a subscription. · --subscription-arn
get-topic-attributesReturns all of the properties of a topic · --topic-arn
list-endpoints-by-platform-applicationLists the endpoints and endpoint attributes for devices in a supported push notification service, such as GCM (Firebase Cloud Messaging) and APNS · --platform-application-arn
list-origination-numbersLists the calling Amazon Web Services account's dedicated origination numbers and their metadata
list-phone-numbers-opted-outReturns a list of phone numbers that are opted out, meaning you cannot send SMS messages to them
list-platform-applicationsLists the platform application objects for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging)
list-sms-sandbox-phone-numbersLists the calling Amazon Web Services account's current verified and pending destination phone numbers in the SMS sandbox
list-subscriptionsReturns a list of the requester's subscriptions
list-subscriptions-by-topicReturns a list of the subscriptions to a specific topic · --topic-arn
list-tags-for-resourceList all tags added to the specified Amazon SNS topic · --resource-arn
list-topicsReturns a list of the requester's topics
opt-in-phone-numberUse this request to opt in a phone number that is opted out, which enables you to resume sending SMS messages to the number · --phone-number
publishSends a message to an Amazon SNS topic, a text message (SMS message) directly to a phone number, or a message to a mobile platform endpoint (when you specify the TargetAr · --message
publish-batchPublishes up to 10 messages to the specified topic in a single batch · --topic-arn --publish-batch-request-entries
put-data-protection-policyAdds or updates an inline policy document that is stored in the specified Amazon SNS topic. · --resource-arn --data-protection-policy
remove-permissionRemoves a statement from a topic's access control policy · --topic-arn --label
set-endpoint-attributesSets the attributes for an endpoint for a device on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS · --endpoint-arn --attributes
set-platform-application-attributesSets the attributes of the platform application object for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging) · --platform-application-arn --attributes
set-sms-attributesUse this request to set the default settings for sending SMS messages and receiving daily SMS usage reports · --attributes
set-subscription-attributesAllows a subscription owner to set an attribute of the subscription to a new value. · --subscription-arn --attribute-name
set-topic-attributesAllows a topic owner to set an attribute of the topic to a new value · --topic-arn --attribute-name
subscribeSubscribes an endpoint to an Amazon SNS topic · --topic-arn --protocol
tag-resourceAdd tags to the specified Amazon SNS topic · --resource-arn --tags
unsubscribeDeletes a subscription · --subscription-arn
untag-resourceRemove tags from the specified Amazon SNS topic · --resource-arn --tag-keys
verify-sms-sandbox-phone-numberVerifies a destination phone number with a one-time password (OTP) for the calling Amazon Web Services account · --phone-number --one-time-password

aws sqs

23

Amazon Simple Queue Service · api 2012-11-05 · 23 commands

add-permissionAdds a permission to a queue for a specific principal · --queue-url --label --aws-account-ids --actions
cancel-message-move-taskCancels a specified message movement task · --task-handle
change-message-visibilityChanges the visibility timeout of a specified message in a queue to a new value · --queue-url --receipt-handle --visibility-timeout
change-message-visibility-batchChanges the visibility timeout of multiple messages · --queue-url --entries
create-queueCreates a new standard or FIFO queue · --queue-name
delete-messageDeletes the specified message from the specified queue · --queue-url --receipt-handle
delete-message-batchDeletes up to ten messages from the specified queue · --queue-url --entries
delete-queueDeletes the queue specified by the QueueUrl, regardless of the queue's contents · --queue-url
get-queue-attributesGets attributes for the specified queue · --queue-url
get-queue-urlThe GetQueueUrl API returns the URL of an existing Amazon SQS queue · --queue-name
list-dead-letter-source-queuesReturns a list of your queues that have the RedrivePolicy queue attribute configured with a dead-letter queue · --queue-url
list-message-move-tasksGets the most recent message movement tasks (up to 10) under a specific source queue · --source-arn
list-queue-tagsList all cost allocation tags added to the specified Amazon SQS queue · --queue-url
list-queuesReturns a list of your queues in the current region
purge-queueDeletes available messages in a queue (including in-flight messages) specified by the QueueURL parameter · --queue-url
receive-messageRetrieves one or more messages (up to 10), from the specified queue · --queue-url
remove-permissionRevokes any permissions in the queue policy that matches the specified Label parameter · --queue-url --label
send-messageDelivers a message to the specified queue · --queue-url --message-body
send-message-batchYou can use SendMessageBatch to send up to 10 messages to the specified queue by assigning either identical or different values to each message (or by not assigning value · --queue-url --entries
set-queue-attributesSets the value of one or more queue attributes, like a policy · --queue-url --attributes
start-message-move-taskStarts an asynchronous task to move messages from a specified source queue to a specified destination queue · --source-arn
tag-queueAdd cost allocation tags to the specified Amazon SQS queue · --queue-url --tags
untag-queueRemove cost allocation tags from the specified Amazon SQS queue · --queue-url --tag-keys

aws cloudformation

90

AWS CloudFormation · api 2010-05-15 · 90 commands

activate-organizations-accessActivate trusted access with Organizations
activate-typeActivates a public third-party extension, such as a resource or module, to make it available for use in stack templates in your current account and Region
batch-describe-type-configurationsReturns configuration data for the specified CloudFormation extensions, from the CloudFormation registry in your current account and Region · --type-configuration-identifiers
cancel-update-stackCancels an update on the specified stack · --stack-name
continue-update-rollbackContinues rolling back a stack from UPDATE_ROLLBACK_FAILED to UPDATE_ROLLBACK_COMPLETE state · --stack-name
create-change-setCreates a list of changes that will be applied to a stack so that you can review the changes before executing them · --stack-name --change-set-name
create-generated-templateCreates a template from existing resources that are not already managed with CloudFormation · --generated-template-name
create-stackCreates a stack as specified in the template · --stack-name
create-stack-instancesCreates stack instances for the specified accounts, within the specified Amazon Web Services Regions · --stack-set-name --regions
create-stack-refactorCreates a refactor across multiple stacks, with the list of stacks and resources that are affected. · --stack-definitions
create-stack-setCreates a StackSet. · --stack-set-name
deactivate-organizations-accessDeactivates trusted access with Organizations
deactivate-typeDeactivates a public third-party extension, such as a resource or module, or a CloudFormation Hook when you no longer use it
delete-change-setDeletes the specified change set · --change-set-name
delete-generated-templateDeleted a generated template. · --generated-template-name
delete-stackDeletes a specified stack · --stack-name
delete-stack-instancesDeletes stack instances for the specified accounts, in the specified Amazon Web Services Regions · --stack-set-name --regions --retain-stacks
delete-stack-setDeletes a StackSet · --stack-set-name
deregister-typeMarks an extension or extension version as DEPRECATED in the CloudFormation registry, removing it from active use
describe-account-limitsRetrieves your account's CloudFormation limits, such as the maximum number of stacks that you can create in your account
describe-change-setReturns the inputs for the change set and a list of changes that CloudFormation will make if you execute the change set · --change-set-name
describe-change-set-hooksReturns Hook-related information for the change set and a list of changes that CloudFormation makes when you run the change set. · --change-set-name
describe-eventsReturns CloudFormation events based on flexible query criteria
describe-generated-templateDescribes a generated template · --generated-template-name
describe-organizations-accessRetrieves information about the account's OrganizationAccess status
describe-publisherReturns information about a CloudFormation extension publisher
describe-resource-scanDescribes details of a resource scan. · --resource-scan-id
describe-stack-drift-detection-statusReturns information about a stack drift detection operation · --stack-drift-detection-id
describe-stack-eventsReturns all stack related events for a specified stack in reverse chronological order · --stack-name
describe-stack-instanceReturns the stack instance that's associated with the specified StackSet, Amazon Web Services account, and Amazon Web Services Region · --stack-set-name --stack-instance-account --stack-instance-region
describe-stack-refactorDescribes the stack refactor status. · --stack-refactor-id
describe-stack-resourceReturns a description of the specified resource in the specified stack · --stack-name --logical-resource-id
describe-stack-resource-driftsReturns drift information for the resources that have been checked for drift in the specified stack · --stack-name
describe-stack-resourcesReturns Amazon Web Services resource descriptions for running and deleted stacks
describe-stack-setReturns the description of the specified StackSet · --stack-set-name
describe-stack-set-operationReturns the description of the specified StackSet operation · --stack-set-name --operation-id
describe-stacksReturns the description for the specified stack; if no stack name was specified, then it returns the description for all the stacks created
describe-typeReturns detailed information about an extension from the CloudFormation registry in your current account and Region
describe-type-registrationReturns information about an extension's registration, including its current status and type and version identifiers · --registration-token
detect-stack-driftDetects whether a stack's actual configuration differs, or has drifted, from its expected configuration, as defined in the stack template and any values specified as temp · --stack-name
detect-stack-resource-driftReturns information about whether a resource's actual configuration differs, or has drifted, from its expected configuration, as defined in the stack template and any val · --stack-name --logical-resource-id
detect-stack-set-driftDetect drift on a StackSet · --stack-set-name
estimate-template-costReturns the estimated monthly cost of a template
execute-change-setUpdates a stack using the input information that was provided when the specified change set was created · --change-set-name
execute-stack-refactorExecutes the stack refactor operation. · --stack-refactor-id
get-generated-templateRetrieves a generated template · --generated-template-name
get-hook-resultRetrieves detailed information and remediation guidance for a Hook invocation result
get-stack-policyReturns the stack policy for a specified stack · --stack-name
get-templateReturns the template body for a specified stack
get-template-summaryReturns information about a new or existing template
import-stacks-to-stack-setImport existing stacks into a new StackSets · --stack-set-name
list-change-setsReturns the ID and status of each active change set for a stack · --stack-name
list-exportsLists all exported output values in the account and Region in which you call this action
list-generated-templatesLists your generated templates in this Region.
list-hook-resultsReturns summaries of invoked Hooks
list-importsLists all stacks that are importing an exported output value · --export-name
list-resource-scan-related-resourcesLists the related resources for a list of resources from a resource scan · --resource-scan-id --resources
list-resource-scan-resourcesLists the resources from a resource scan · --resource-scan-id
list-resource-scansList the resource scans from newest to oldest
list-stack-instance-resource-driftsReturns drift information for resources in a stack instance · --stack-set-name --stack-instance-account --stack-instance-region --operation-id
list-stack-instancesReturns summary information about stack instances that are associated with the specified StackSet · --stack-set-name
list-stack-refactor-actionsLists the stack refactor actions that will be taken after calling the ExecuteStackRefactor action. · --stack-refactor-id
list-stack-refactorsLists all account stack refactor operations and their statuses.
list-stack-resourcesReturns descriptions of all resources of the specified stack · --stack-name
list-stack-set-auto-deployment-targetsReturns summary information about deployment targets for a StackSet. · --stack-set-name
list-stack-set-operation-resultsReturns summary information about the results of a StackSet operation · --stack-set-name --operation-id
list-stack-set-operationsReturns summary information about operations performed on a StackSet · --stack-set-name
list-stack-setsReturns summary information about StackSets that are associated with the user
list-stacksReturns the summary information for stacks whose status matches the specified StackStatusFilter
list-type-registrationsReturns a list of registration tokens for the specified extension(s).
list-type-versionsReturns summary information about the versions of an extension.
list-typesReturns summary information about all extensions, including your private resource types, modules, and Hooks as well as all public extensions from Amazon Web Services and
publish-typePublishes the specified extension to the CloudFormation registry as a public extension in this Region
record-handler-progressReports progress of a resource handler to CloudFormation · --bearer-token --operation-status
register-publisherRegisters your account as a publisher of public extensions in the CloudFormation registry
register-typeRegisters an extension with the CloudFormation service · --type-name --schema-handler-package
rollback-stackWhen specifying RollbackStack, you preserve the state of previously provisioned resources when an operation fails · --stack-name
set-stack-policySets a stack policy for a specified stack. · --stack-name
set-type-configurationSpecifies the configuration data for a CloudFormation extension, such as a resource or Hook, in the given account and Region · --configuration
set-type-default-versionSpecify the default version of an extension
signal-resourceSends a signal to the specified resource with a success or failure status · --stack-name --logical-resource-id --unique-id --status
start-resource-scanStarts a scan of the resources in this account in this Region
stop-stack-set-operationStops an in-progress operation on a StackSet and its associated stack instances · --stack-set-name --operation-id
test-typeTests a registered extension to make sure it meets all necessary requirements for being published in the CloudFormation registry
update-generated-templateUpdates a generated template · --generated-template-name
update-stackUpdates a stack as specified in the template · --stack-name
update-stack-instancesUpdates the parameter values for stack instances for the specified accounts, within the specified Amazon Web Services Regions · --stack-set-name --regions
update-stack-setUpdates the StackSet and associated stack instances in the specified accounts and Amazon Web Services Regions · --stack-set-name
update-termination-protectionUpdates termination protection for the specified stack · --enable-termination-protection --stack-name
validate-templateValidates a specified template

aws ecr

58

Amazon Elastic Container Registry · api 2015-09-21 · 58 commands

batch-check-layer-availabilityChecks the availability of one or more image layers in a repository · --repository-name --layer-digests
batch-delete-imageDeletes a list of specified images within a repository · --repository-name --image-ids
batch-get-imageGets detailed information for an image · --repository-name --image-ids
batch-get-repository-scanning-configurationGets the scanning configuration for one or more repositories. · --repository-names
complete-layer-uploadInforms Amazon ECR that the image layer upload has completed for a specified registry, repository name, and upload ID · --repository-name --upload-id --layer-digests
create-pull-through-cache-ruleCreates a pull through cache rule · --ecr-repository-prefix --upstream-registry-url
create-repositoryCreates a repository · --repository-name
create-repository-creation-templateCreates a repository creation template · --prefix --applied-for
delete-lifecycle-policyDeletes the lifecycle policy associated with the specified repository. · --repository-name
delete-pull-through-cache-ruleDeletes a pull through cache rule. · --ecr-repository-prefix
delete-registry-policyDeletes the registry permissions policy.
delete-repositoryDeletes a repository · --repository-name
delete-repository-creation-templateDeletes a repository creation template. · --prefix
delete-repository-policyDeletes the repository policy associated with the specified repository. · --repository-name
delete-signing-configurationDeletes the registry's signing configuration
deregister-pull-time-update-exclusionRemoves a principal from the pull time update exclusion list for a registry · --principal-arn
describe-image-replication-statusReturns the replication status for a specified image. · --repository-name --image-id
describe-image-scan-findingsReturns the scan findings for the specified image. · --repository-name --image-id
describe-image-signing-statusReturns the signing status for a specified image · --repository-name --image-id
describe-imagesReturns metadata about the images in a repository · --repository-name
describe-pull-through-cache-rulesReturns the pull through cache rules for a registry.
describe-registryDescribes the settings for a registry
describe-repositoriesDescribes image repositories in a registry.
describe-repository-creation-templatesReturns details about the repository creation templates in a registry
get-account-settingRetrieves the account setting value for the specified setting name. · --name
get-authorization-tokenRetrieves an authorization token
get-download-url-for-layerRetrieves the pre-signed Amazon S3 download URL corresponding to an image layer · --repository-name --layer-digest
get-lifecycle-policyRetrieves the lifecycle policy for the specified repository. · --repository-name
get-lifecycle-policy-previewRetrieves the results of the lifecycle policy preview request for the specified repository. · --repository-name
get-registry-policyRetrieves the permissions policy for a registry.
get-registry-scanning-configurationRetrieves the scanning configuration for a registry.
get-repository-policyRetrieves the repository policy for the specified repository. · --repository-name
get-signing-configurationRetrieves the registry's signing configuration, which defines rules for automatically signing images using Amazon Web Services Signer
initiate-layer-uploadNotifies Amazon ECR that you intend to upload an image layer · --repository-name
list-image-referrersLists the artifacts associated with a specified subject image · --repository-name --subject-id
list-imagesLists all the image IDs for the specified repository · --repository-name
list-pull-time-update-exclusionsLists the IAM principals that are excluded from having their image pull times recorded.
list-tags-for-resourceList the tags for an Amazon ECR resource. · --resource-arn
put-account-settingAllows you to change the basic scan type version or registry policy scope. · --name --value
put-imageCreates or updates the image manifest and tags associated with an image · --repository-name --image-manifest
put-image-scanning-configurationThe PutImageScanningConfiguration API is being deprecated, in favor of specifying the image scanning configuration at the registry level · --repository-name --image-scanning-configuration
put-image-tag-mutabilityUpdates the image tag mutability settings for the specified repository · --repository-name --image-tag-mutability
put-lifecycle-policyCreates or updates the lifecycle policy for the specified repository · --repository-name --lifecycle-policy-text
put-registry-policyCreates or updates the permissions policy for your registry · --policy-text
put-registry-scanning-configurationCreates or updates the scanning configuration for your private registry.
put-replication-configurationCreates or updates the replication configuration for a registry · --replication-configuration
put-signing-configurationCreates or updates the registry's signing configuration, which defines rules for automatically signing images with Amazon Web Services Signer · --signing-configuration
register-pull-time-update-exclusionAdds an IAM principal to the pull time update exclusion list for a registry · --principal-arn
set-repository-policyApplies a repository policy to the specified repository to control access permissions · --repository-name --policy-text
start-image-scanStarts a basic image vulnerability scan · --repository-name --image-id
start-lifecycle-policy-previewStarts a preview of a lifecycle policy for the specified repository · --repository-name
tag-resourceAdds specified tags to a resource with the specified ARN · --resource-arn --tags
untag-resourceDeletes specified tags from a resource. · --resource-arn --tag-keys
update-image-storage-classTransitions an image between storage classes · --repository-name --image-id --target-storage-class
update-pull-through-cache-ruleUpdates an existing pull through cache rule. · --ecr-repository-prefix
update-repository-creation-templateUpdates an existing repository creation template. · --prefix
upload-layer-partUploads an image layer part to Amazon ECR · --repository-name --upload-id --part-first-byte --part-last-byte --layer-part-blob
validate-pull-through-cache-ruleValidates an existing pull through cache rule for an upstream registry that requires authentication · --ecr-repository-prefix

aws ecs

64

Amazon EC2 Container Service · api 2014-11-13 · 64 commands

create-capacity-providerCreates a capacity provider · --name
create-clusterCreates a new Amazon ECS cluster
create-express-gateway-serviceCreates an Express service that simplifies deploying containerized web applications on Amazon ECS with managed Amazon Web Services infrastructure · --execution-role-arn --infrastructure-role-arn --primary-container
create-serviceRuns and maintains your desired number of tasks from a specified task definition · --service-name
create-task-setCreate a task set in the specified cluster and service · --service --cluster --task-definition
delete-account-settingDisables an account setting for a specified user, role, or the root user for an account. · --name
delete-attributesDeletes one or more custom attributes from an Amazon ECS resource. · --attributes
delete-capacity-providerDeletes the specified capacity provider · --capacity-provider
delete-clusterDeletes the specified cluster · --cluster
delete-express-gateway-serviceDeletes an Express service and removes all associated Amazon Web Services resources · --service-arn
delete-serviceDeletes a specified service within a cluster · --service
delete-task-definitionsDeletes one or more task definitions · --task-definitions
delete-task-setDeletes a specified task set within a service · --cluster --service --task-set
deregister-container-instanceDeregisters an Amazon ECS container instance from the specified cluster · --container-instance
deregister-task-definitionDeregisters the specified task definition by family and revision · --task-definition
describe-capacity-providersDescribes one or more of your capacity providers.
describe-clustersDescribes one or more of your clusters
describe-container-instancesDescribes one or more container instances · --container-instances
describe-express-gateway-serviceRetrieves detailed information about an Express service, including current status, configuration, managed infrastructure, and service revisions · --service-arn
describe-service-deploymentsDescribes one or more of your service deployments · --service-deployment-arns
describe-service-revisionsDescribes one or more service revisions · --service-revision-arns
describe-servicesDescribes the specified services running in your cluster. · --services
describe-task-definitionDescribes a task definition · --task-definition
describe-task-setsDescribes the task sets in the specified cluster and service · --cluster --service
describe-tasksDescribes a specified task or tasks · --tasks
discover-poll-endpointThis action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent
execute-commandRuns a command remotely on a container within a task · --command --interactive --task
get-task-protectionRetrieves the protection status of tasks in an Amazon ECS service. · --cluster
list-account-settingsLists the account settings for a specified principal.
list-attributesLists the attributes for Amazon ECS resources within a specified target type and cluster · --target-type
list-clustersReturns a list of existing clusters.
list-container-instancesReturns a list of container instances in a specified cluster
list-service-deploymentsThis operation lists all the service deployments that meet the specified filter criteria · --service
list-servicesReturns a list of services
list-services-by-namespaceThis operation lists all of the services that are associated with a Cloud Map namespace · --namespace
list-tags-for-resourceList the tags for an Amazon ECS resource. · --resource-arn
list-task-definition-familiesReturns a list of task definition families that are registered to your account
list-task-definitionsReturns a list of task definitions that are registered to your account
list-tasksReturns a list of tasks
put-account-settingModifies an account setting · --name --value
put-account-setting-defaultModifies an account setting for all users on an account for whom no individual account setting has been specified · --name --value
put-attributesCreate or update an attribute on an Amazon ECS resource · --attributes
put-cluster-capacity-providersModifies the available capacity providers and the default capacity provider strategy for a cluster · --cluster --capacity-providers --default-capacity-provider-strategy
register-container-instanceThis action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent
register-task-definitionRegisters a new task definition from the supplied family and containerDefinitions · --family --container-definitions
run-taskStarts a new task using the specified task definition · --task-definition
start-taskStarts a new task from the specified task definition on the specified container instance or instances · --container-instances --task-definition
stop-service-deploymentStops an ongoing service deployment · --service-deployment-arn
stop-taskStops a running task · --task
submit-attachment-state-changesThis action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent · --attachments
submit-container-state-changeThis action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent
submit-task-state-changeThis action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent
tag-resourceAssociates the specified tags to a resource with the specified resourceArn · --resource-arn --tags
untag-resourceDeletes specified tags from a resource. · --resource-arn --tag-keys
update-capacity-providerModifies the parameters for a capacity provider · --name
update-clusterUpdates the cluster. · --cluster
update-cluster-settingsModifies the settings to use for a cluster. · --cluster --settings
update-container-agentUpdates the Amazon ECS container agent on a specified container instance · --container-instance
update-container-instances-stateModifies the status of an Amazon ECS container instance · --container-instances --status
update-express-gateway-serviceUpdates an existing Express service configuration · --service-arn
update-serviceModifies the parameters of a service · --service
update-service-primary-task-setModifies which task set in a service is the primary task set · --cluster --service --primary-task-set
update-task-protectionUpdates the protection status of a task · --cluster --tasks --protection-enabled
update-task-setModifies a task set · --cluster --service --task-set --scale

aws bedrock

98

Amazon Bedrock · api 2023-04-20 · 98 commands

batch-delete-evaluation-jobDeletes a batch of evaluation jobs · --job-identifiers
cancel-automated-reasoning-policy-build-workflowCancels a running Automated Reasoning policy build workflow · --policy-arn --build-workflow-id
create-automated-reasoning-policyCreates an Automated Reasoning policy for Amazon Bedrock Guardrails · --name
create-automated-reasoning-policy-test-caseCreates a test for an Automated Reasoning policy · --policy-arn --guard-content --expected-aggregated-findings-result
create-automated-reasoning-policy-versionCreates a new version of an existing Automated Reasoning policy · --policy-arn --last-updated-definition-hash
create-custom-modelCreates a new custom model in Amazon Bedrock · --model-name --model-source-config
create-custom-model-deploymentDeploys a custom model for on-demand inference in Amazon Bedrock · --model-deployment-name --model-arn
create-evaluation-jobCreates an evaluation job. · --job-name --role-arn --evaluation-config --inference-config --output-data-config
create-foundation-model-agreementRequest a model access agreement for the specified model. · --offer-token --model-id
create-guardrailCreates a guardrail to block topics and to implement safeguards for your generative AI applications · --name --blocked-input-messaging --blocked-outputs-messaging
create-guardrail-versionCreates a version of the guardrail · --guardrail-identifier
create-inference-profileCreates an application inference profile to track metrics and costs when invoking a model · --inference-profile-name --model-source
create-marketplace-model-endpointCreates an endpoint for a model from Amazon Bedrock Marketplace · --model-source-identifier --endpoint-config --endpoint-name
create-model-copy-jobCopies a model to another region so that it can be used there · --source-model-arn --target-model-name
create-model-customization-jobCreates a fine-tuning job to customize a base model · --job-name --custom-model-name --role-arn --base-model-identifier --training-data-config --output-data-config
create-model-import-jobCreates a model import job to import model that you have customized in other environments, such as Amazon SageMaker · --job-name --imported-model-name --role-arn --model-data-source
create-model-invocation-jobCreates a batch inference job to invoke a model on multiple prompts · --job-name --role-arn --model-id --input-data-config --output-data-config
create-prompt-routerCreates a prompt router that manages the routing of requests between multiple foundation models based on the routing criteria. · --prompt-router-name --models --routing-criteria --fallback-model
create-provisioned-model-throughputCreates dedicated throughput for a base or custom model with the model units and for the duration that you specify · --model-units --provisioned-model-name --model-id
delete-automated-reasoning-policyDeletes an Automated Reasoning policy or policy version · --policy-arn
delete-automated-reasoning-policy-build-workflowDeletes an Automated Reasoning policy build workflow and its associated artifacts · --policy-arn --build-workflow-id --last-updated-at
delete-automated-reasoning-policy-test-caseDeletes an Automated Reasoning policy test · --policy-arn --test-case-id --last-updated-at
delete-custom-modelDeletes a custom model that you created earlier · --model-identifier
delete-custom-model-deploymentDeletes a custom model deployment · --custom-model-deployment-identifier
delete-enforced-guardrail-configurationDeletes the account-level enforced guardrail configuration. · --config-id
delete-foundation-model-agreementDelete the model access agreement for the specified model. · --model-id
delete-guardrailDeletes a guardrail · --guardrail-identifier
delete-imported-modelDeletes a custom model that you imported earlier · --model-identifier
delete-inference-profileDeletes an application inference profile · --inference-profile-identifier
delete-marketplace-model-endpointDeletes an endpoint for a model from Amazon Bedrock Marketplace. · --endpoint-arn
delete-model-invocation-logging-configurationDelete the invocation logging.
delete-prompt-routerDeletes a specified prompt router · --prompt-router-arn
delete-provisioned-model-throughputDeletes a Provisioned Throughput · --provisioned-model-id
deregister-marketplace-model-endpointDeregisters an endpoint for a model from Amazon Bedrock Marketplace · --endpoint-arn
export-automated-reasoning-policy-versionExports the policy definition for an Automated Reasoning policy version · --policy-arn
get-automated-reasoning-policyRetrieves details about an Automated Reasoning policy or policy version · --policy-arn
get-automated-reasoning-policy-annotationsRetrieves the current annotations for an Automated Reasoning policy build workflow · --policy-arn --build-workflow-id
get-automated-reasoning-policy-build-workflowRetrieves detailed information about an Automated Reasoning policy build workflow, including its status, configuration, and metadata. · --policy-arn --build-workflow-id
get-automated-reasoning-policy-build-workflow-result-assetsRetrieves the resulting assets from a completed Automated Reasoning policy build workflow, including build logs, quality reports, and generated policy artifacts. · --policy-arn --build-workflow-id --asset-type
get-automated-reasoning-policy-next-scenarioRetrieves the next test scenario for validating an Automated Reasoning policy · --policy-arn --build-workflow-id
get-automated-reasoning-policy-test-caseRetrieves details about a specific Automated Reasoning policy test. · --policy-arn --test-case-id
get-automated-reasoning-policy-test-resultRetrieves the test result for a specific Automated Reasoning policy test · --policy-arn --build-workflow-id --test-case-id
get-custom-modelGet the properties associated with a Amazon Bedrock custom model that you have created · --model-identifier
get-custom-model-deploymentRetrieves information about a custom model deployment, including its status, configuration, and metadata · --custom-model-deployment-identifier
get-evaluation-jobGets information about an evaluation job, such as the status of the job. · --job-identifier
get-foundation-modelGet details about a Amazon Bedrock foundation model. · --model-identifier
get-foundation-model-availabilityGet information about the Foundation model availability. · --model-id
get-guardrailGets details about a guardrail · --guardrail-identifier
get-imported-modelGets properties associated with a customized model you imported. · --model-identifier
get-inference-profileGets information about an inference profile · --inference-profile-identifier
get-marketplace-model-endpointRetrieves details about a specific endpoint for a model from Amazon Bedrock Marketplace. · --endpoint-arn
get-model-copy-jobRetrieves information about a model copy job · --job-arn
get-model-customization-jobRetrieves the properties associated with a model-customization job, including the status of the job · --job-identifier
get-model-import-jobRetrieves the properties associated with import model job, including the status of the job · --job-identifier
get-model-invocation-jobGets details about a batch inference job · --job-identifier
get-model-invocation-logging-configurationGet the current configuration values for model invocation logging.
get-prompt-routerRetrieves details about a prompt router. · --prompt-router-arn
get-provisioned-model-throughputReturns details for a Provisioned Throughput · --provisioned-model-id
get-use-case-for-model-accessGet usecase for model access.
list-automated-reasoning-policiesLists all Automated Reasoning policies in your account, with optional filtering by policy ARN
list-automated-reasoning-policy-build-workflowsLists all build workflows for an Automated Reasoning policy, showing the history of policy creation and modification attempts. · --policy-arn
list-automated-reasoning-policy-test-casesLists tests for an Automated Reasoning policy · --policy-arn
list-automated-reasoning-policy-test-resultsLists test results for an Automated Reasoning policy, showing how the policy performed against various test scenarios and validation checks. · --policy-arn --build-workflow-id
list-custom-model-deploymentsLists custom model deployments in your account
list-custom-modelsReturns a list of the custom models that you have created with the CreateModelCustomizationJob operation
list-enforced-guardrails-configurationLists the account-level enforced guardrail configurations.
list-evaluation-jobsLists all existing evaluation jobs.
list-foundation-model-agreement-offersGet the offers associated with the specified model. · --model-id
list-foundation-modelsLists Amazon Bedrock foundation models that you can use
list-guardrailsLists details about all the guardrails in an account
list-imported-modelsReturns a list of models you've imported
list-inference-profilesReturns a list of inference profiles that you can use
list-marketplace-model-endpointsLists the endpoints for models from Amazon Bedrock Marketplace in your Amazon Web Services account.
list-model-copy-jobsReturns a list of model copy jobs that you have submitted
list-model-customization-jobsReturns a list of model customization jobs that you have submitted
list-model-import-jobsReturns a list of import jobs you've submitted
list-model-invocation-jobsLists all batch inference jobs in the account
list-prompt-routersRetrieves a list of prompt routers.
list-provisioned-model-throughputsLists the Provisioned Throughputs in the account
list-tags-for-resourceList the tags associated with the specified resource · --resource-arn
put-enforced-guardrail-configurationSets the account-level enforced guardrail configuration. · --guardrail-inference-config
put-model-invocation-logging-configurationSet the configuration values for model invocation logging. · --logging-config
put-use-case-for-model-accessPut usecase for model access. · --form-data
register-marketplace-model-endpointRegisters an existing Amazon SageMaker endpoint with Amazon Bedrock Marketplace, allowing it to be used with Amazon Bedrock APIs. · --endpoint-identifier --model-source-identifier
start-automated-reasoning-policy-build-workflowStarts a new build workflow for an Automated Reasoning policy · --policy-arn --build-workflow-type --source-content
start-automated-reasoning-policy-test-workflowInitiates a test workflow to validate Automated Reasoning policy tests · --policy-arn --build-workflow-id
stop-evaluation-jobStops an evaluation job that is current being created or running. · --job-identifier
stop-model-customization-jobStops an active model customization job · --job-identifier
stop-model-invocation-jobStops a batch inference job · --job-identifier
tag-resourceAssociate tags with a resource · --resource-arn --tags
untag-resourceRemove one or more tags from a resource · --resource-arn --tag-keys
update-automated-reasoning-policyUpdates an existing Automated Reasoning policy with new rules, variables, or configuration · --policy-arn --policy-definition
update-automated-reasoning-policy-annotationsUpdates the annotations for an Automated Reasoning policy build workflow · --policy-arn --build-workflow-id --annotations --last-updated-annotation-set-hash
update-automated-reasoning-policy-test-caseUpdates an existing Automated Reasoning policy test · --policy-arn --test-case-id --guard-content --last-updated-at --expected-aggregated-findings-result
update-custom-model-deploymentUpdates a custom model deployment with a new custom model · --model-arn --custom-model-deployment-identifier
update-guardrailUpdates a guardrail with the values you specify · --guardrail-identifier --name --blocked-input-messaging --blocked-outputs-messaging
update-marketplace-model-endpointUpdates the configuration of an existing endpoint for a model from Amazon Bedrock Marketplace. · --endpoint-arn --endpoint-config
update-provisioned-model-throughputUpdates the name or associated model for a Provisioned Throughput · --provisioned-model-id

aws bedrock-runtime

10

Amazon Bedrock Runtime · api 2023-09-30 · 10 commands

apply-guardrailThe action to apply a guardrail · --guardrail-identifier --guardrail-version --source --content
converseSends messages to the specified Amazon Bedrock model · --model-id
converse-streamSends messages to the specified Amazon Bedrock model and returns the response in a stream · --model-id
count-tokensReturns the token count for a given inference request · --model-id --input
get-async-invokeRetrieve information about an asynchronous invocation. · --invocation-arn
invoke-modelInvokes the specified Amazon Bedrock model to run inference using the prompt and inference parameters provided in the request body · --model-id
invoke-model-with-bidirectional-streamInvoke the specified Amazon Bedrock model to run inference using the bidirectional stream · --model-id --body
invoke-model-with-response-streamInvoke the specified Amazon Bedrock model to run inference using the prompt and inference parameters provided in the request body · --model-id
list-async-invokesLists asynchronous invocations.
start-async-invokeStarts an asynchronous invocation · --model-id --model-input --output-data-config

aws ce (Cost Explorer)

47

AWS Cost Explorer Service · api 2017-10-25 · 47 commands

create-anomaly-monitorCreates a new cost anomaly detection monitor with the requested type and monitor specification. · --anomaly-monitor
create-anomaly-subscriptionAdds an alert subscription to a cost anomaly detection monitor · --anomaly-subscription
create-cost-category-definitionCreates a new cost category with the requested name and rules. · --name --rule-version --rules
delete-anomaly-monitorDeletes a cost anomaly monitor. · --monitor-arn
delete-anomaly-subscriptionDeletes a cost anomaly subscription. · --subscription-arn
delete-cost-category-definitionDeletes a cost category · --cost-category-arn
describe-cost-category-definitionReturns the name, Amazon Resource Name (ARN), rules, definition, and effective dates of a cost category that's defined in the account · --cost-category-arn
get-anomaliesRetrieves all of the cost anomalies detected on your account during the time period that's specified by the DateInterval object · --date-interval
get-anomaly-monitorsRetrieves the cost anomaly monitor definitions for your account
get-anomaly-subscriptionsRetrieves the cost anomaly subscription objects for your account
get-approximate-usage-recordsRetrieves estimated usage records for hourly granularity or resource-level data at daily granularity. · --granularity --approximation-dimension
get-commitment-purchase-analysisRetrieves a commitment purchase analysis result based on the AnalysisId. · --analysis-id
get-cost-and-usageRetrieves cost and usage metrics for your account · --time-period --granularity --metrics
get-cost-and-usage-comparisonsRetrieves cost and usage comparisons for your account between two periods within the last 13 months · --baseline-time-period --comparison-time-period --metric-for-comparison
get-cost-and-usage-with-resourcesRetrieves cost and usage metrics with resources for your account · --time-period --granularity --filter
get-cost-categoriesRetrieves an array of cost category names and values incurred cost · --time-period
get-cost-comparison-driversRetrieves key factors driving cost changes between two time periods within the last 13 months, such as usage changes, discount changes, and commitment-based savings · --baseline-time-period --comparison-time-period --metric-for-comparison
get-cost-forecastRetrieves a forecast for how much Amazon Web Services predicts that you will spend over the forecast time period that you select, based on your past costs. · --time-period --metric --granularity
get-dimension-valuesRetrieves all available filter values for a specified filter over a period of time · --time-period --dimension
get-reservation-coverageRetrieves the reservation coverage for your account, which you can use to see how much of your Amazon Elastic Compute Cloud, Amazon ElastiCache, Amazon Relational Databas · --time-period
get-reservation-purchase-recommendationGets recommendations for reservation purchases · --service
get-reservation-utilizationRetrieves the reservation utilization for your account · --time-period
get-rightsizing-recommendationCreates recommendations that help you save cost by identifying idle and underutilized Amazon EC2 instances · --service
get-savings-plan-purchase-recommendation-detailsRetrieves the details for a Savings Plan recommendation · --recommendation-detail-id
get-savings-plans-coverageRetrieves the Savings Plans covered for your account · --time-period
get-savings-plans-purchase-recommendationRetrieves the Savings Plans recommendations for your account · --savings-plans-type --term-in-years --payment-option --lookback-period-in-days
get-savings-plans-utilizationRetrieves the Savings Plans utilization for your account across date ranges with daily or monthly granularity · --time-period
get-savings-plans-utilization-detailsRetrieves attribute data along with aggregate utilization and savings data for a given time period · --time-period
get-tagsQueries for available tag keys and tag values for a specified period · --time-period
get-usage-forecastRetrieves a forecast for how much Amazon Web Services predicts that you will use over the forecast time period that you select, based on your past usage. · --time-period --metric --granularity
list-commitment-purchase-analysesLists the commitment purchase analyses for your account.
list-cost-allocation-tag-backfill-historyRetrieves a list of your historical cost allocation tag backfill requests.
list-cost-allocation-tagsGet a list of cost allocation tags
list-cost-category-definitionsReturns the name, Amazon Resource Name (ARN), NumberOfRules and effective dates of all cost categories defined in the account
list-cost-category-resource-associationsReturns resource associations of all cost categories defined in the account
list-savings-plans-purchase-recommendation-generationRetrieves a list of your historical recommendation generations within the past 30 days.
list-tags-for-resourceReturns a list of resource tags associated with the resource specified by the Amazon Resource Name (ARN). · --resource-arn
provide-anomaly-feedbackModifies the feedback property of a given cost anomaly. · --anomaly-id --feedback
start-commitment-purchase-analysisSpecifies the parameters of a planned commitment purchase and starts the generation of the analysis · --commitment-purchase-analysis-configuration
start-cost-allocation-tag-backfillRequest a cost allocation tag backfill · --backfill-from
start-savings-plans-purchase-recommendation-generationRequests a Savings Plans recommendation generation
tag-resourceAn API operation for adding one or more tags (key-value pairs) to a resource · --resource-arn --resource-tags
untag-resourceRemoves one or more tags from a resource · --resource-arn --resource-tag-keys
update-anomaly-monitorUpdates an existing cost anomaly monitor · --monitor-arn
update-anomaly-subscriptionUpdates an existing cost anomaly subscription · --subscription-arn
update-cost-allocation-tags-statusUpdates status for cost allocation tags in bulk, with maximum batch size of 20 · --cost-allocation-tags-status
update-cost-category-definitionUpdates an existing cost category · --cost-category-arn --rule-version --rules

aws budgets

26

AWS Budgets · api 2016-10-20 · 26 commands

create-budgetCreates a budget and, if included, notifications and subscribers · --account-id --budget
create-budget-actionCreates a budget action. · --account-id --budget-name --notification-type --action-type --action-threshold --definition --execution-role-arn --approval-model --subscribers
create-notificationCreates a notification · --account-id --budget-name --notification --subscribers
create-subscriberCreates a subscriber · --account-id --budget-name --notification --subscriber
delete-budgetDeletes a budget · --account-id --budget-name
delete-budget-actionDeletes a budget action. · --account-id --budget-name --action-id
delete-notificationDeletes a notification · --account-id --budget-name --notification
delete-subscriberDeletes a subscriber · --account-id --budget-name --notification --subscriber
describe-budgetDescribes a budget · --account-id --budget-name
describe-budget-actionDescribes a budget action detail. · --account-id --budget-name --action-id
describe-budget-action-historiesDescribes a budget action history detail. · --account-id --budget-name --action-id
describe-budget-actions-for-accountDescribes all of the budget actions for an account. · --account-id
describe-budget-actions-for-budgetDescribes all of the budget actions for a budget. · --account-id --budget-name
describe-budget-notifications-for-accountLists the budget names and notifications that are associated with an account. · --account-id
describe-budget-performance-historyDescribes the history for DAILY, MONTHLY, and QUARTERLY budgets · --account-id --budget-name
describe-budgetsLists the budgets that are associated with an account · --account-id
describe-notifications-for-budgetLists the notifications that are associated with a budget. · --account-id --budget-name
describe-subscribers-for-notificationLists the subscribers that are associated with a notification. · --account-id --budget-name --notification
execute-budget-actionExecutes a budget action. · --account-id --budget-name --action-id --execution-type
list-tags-for-resourceLists tags associated with a budget or budget action resource. · --resource-arn
tag-resourceCreates tags for a budget or budget action resource. · --resource-arn --resource-tags
untag-resourceDeletes tags associated with a budget or budget action resource. · --resource-arn --resource-tag-keys
update-budgetUpdates a budget · --account-id --new-budget
update-budget-actionUpdates a budget action. · --account-id --budget-name --action-id
update-notificationUpdates a notification. · --account-id --budget-name --old-notification --new-notification
update-subscriberUpdates a subscriber. · --account-id --budget-name --notification --old-subscriber --new-subscriber

aws organizations

63

AWS Organizations · api 2016-11-28 · 63 commands

accept-handshakeAccepts a handshake by sending an ACCEPTED response to the sender · --handshake-id
attach-policyAttaches a policy to a root, an organizational unit (OU), or an individual account · --policy-id --target-id
cancel-handshakeCancels a Handshake · --handshake-id
close-accountCloses an Amazon Web Services member account within an organization · --account-id
create-accountCreates an Amazon Web Services account that is automatically a member of the organization whose credentials made the request · --email --account-name
create-gov-cloud-accountThis action is available if all of the following are true: You're authorized to create accounts in the Amazon Web Services GovCloud (US) Region · --email --account-name
create-organizationCreates an Amazon Web Services organization
create-organizational-unitCreates an organizational unit (OU) within a root or parent OU · --parent-id --name
create-policyCreates a policy of a specified type that you can attach to a root, an organizational unit (OU), or an individual Amazon Web Services account · --content --description --name --type
decline-handshakeDeclines a Handshake · --handshake-id
delete-organizationDeletes the organization
delete-organizational-unitDeletes an organizational unit (OU) from a root or another OU · --organizational-unit-id
delete-policyDeletes the specified policy from your organization · --policy-id
delete-resource-policyDeletes the resource policy from your organization
deregister-delegated-administratorRemoves the specified member Amazon Web Services account as a delegated administrator for the specified Amazon Web Services service · --account-id --service-principal
describe-accountRetrieves Organizations-related information about the specified account · --account-id
describe-create-account-statusRetrieves the current status of an asynchronous request to create an account · --create-account-request-id
describe-effective-policyReturns the contents of the effective policy for specified policy type and account · --policy-type
describe-handshakeReturns details for a handshake · --handshake-id
describe-organizationRetrieves information about the organization that the user's account belongs to
describe-organizational-unitRetrieves information about an organizational unit (OU) · --organizational-unit-id
describe-policyRetrieves information about a policy · --policy-id
describe-resource-policyRetrieves information about a resource policy
describe-responsibility-transferReturns details for a transfer · --id
detach-policyDetaches a policy from a target root, organizational unit (OU), or account · --policy-id --target-id
disable-aws-service-accessDisables the integration of an Amazon Web Services service (the service that is specified by ServicePrincipal) with Organizations · --service-principal
disable-policy-typeDisables an organizational policy type in a root · --root-id --policy-type
enable-aws-service-accessProvides an Amazon Web Services service (the service that is specified by ServicePrincipal) with permissions to view the structure of an organization, create a service-li · --service-principal
enable-all-featuresEnables all features in an organization
enable-policy-typeEnables a policy type in a root · --root-id --policy-type
invite-account-to-organizationSends an invitation to another account to join your organization as a member account · --target
invite-organization-to-transfer-responsibilitySends an invitation to another organization's management account to designate your account with the specified responsibilities for their organization · --type --target --start-timestamp --source-name
leave-organizationRemoves a member account from its parent organization
list-aws-service-access-for-organizationReturns a list of the Amazon Web Services services that you enabled to integrate with your organization
list-accountsLists all the accounts in the organization
list-accounts-for-parentLists the accounts in an organization that are contained by the specified target root or organizational unit (OU) · --parent-id
list-accounts-with-invalid-effective-policyLists all the accounts in an organization that have invalid effective policies · --policy-type
list-childrenLists all of the organizational units (OUs) or accounts that are contained in the specified parent OU or root · --parent-id --child-type
list-create-account-statusLists the account creation requests that match the specified status that is currently being tracked for the organization
list-delegated-administratorsLists the Amazon Web Services accounts that are designated as delegated administrators in this organization
list-delegated-services-for-accountList the Amazon Web Services services for which the specified account is a delegated administrator · --account-id
list-effective-policy-validation-errorsLists all the validation errors on an effective policy for a specified account and policy type · --account-id --policy-type
list-handshakes-for-accountLists the recent handshakes that you have received
list-handshakes-for-organizationLists the recent handshakes that you have sent
list-inbound-responsibility-transfersLists transfers that allow you to manage the specified responsibilities for another organization · --type
list-organizational-units-for-parentLists the organizational units (OUs) in a parent organizational unit or root · --parent-id
list-outbound-responsibility-transfersLists transfers that allow an account outside your organization to manage the specified responsibilities for your organization · --type
list-parentsLists the root or organizational units (OUs) that serve as the immediate parent of the specified child OU or account · --child-id
list-policiesRetrieves the list of all policies in an organization of a specified type · --filter
list-policies-for-targetLists the policies that are directly attached to the specified target root, organizational unit (OU), or account · --target-id --filter
list-rootsLists the roots that are defined in the current organization
list-tags-for-resourceLists tags that are attached to the specified resource · --resource-id
list-targets-for-policyLists all the roots, organizational units (OUs), and accounts that the specified policy is attached to · --policy-id
move-accountMoves an account from its current source parent root or organizational unit (OU) to the specified destination parent root or OU · --account-id --source-parent-id --destination-parent-id
put-resource-policyCreates or updates a resource policy · --content
register-delegated-administratorEnables the specified member account to administer the Organizations features of the specified Amazon Web Services service · --account-id --service-principal
remove-account-from-organizationRemoves the specified account from the organization · --account-id
tag-resourceAdds one or more tags to the specified resource · --resource-id --tags
terminate-responsibility-transferEnds a transfer · --id
untag-resourceRemoves any tags with the specified keys from the specified resource · --resource-id --tag-keys
update-organizational-unitRenames the specified organizational unit (OU) · --organizational-unit-id
update-policyUpdates an existing policy with a new name, description, or content · --policy-id
update-responsibility-transferUpdates a transfer · --id --name

aws amplify

37

AWS Amplify · api 2017-07-25 · 37 commands

create-appCreates a new Amplify app. · --name
create-backend-environmentCreates a new backend environment for an Amplify app · --app-id --environment-name
create-branchCreates a new branch for an Amplify app. · --app-id --branch-name
create-deploymentCreates a deployment for a manually deployed Amplify app · --app-id --branch-name
create-domain-associationCreates a new domain association for an Amplify app · --app-id --domain-name --sub-domain-settings
create-webhookCreates a new webhook on an Amplify app. · --app-id --branch-name
delete-appDeletes an existing Amplify app specified by an app ID. · --app-id
delete-backend-environmentDeletes a backend environment for an Amplify app · --app-id --environment-name
delete-branchDeletes a branch for an Amplify app. · --app-id --branch-name
delete-domain-associationDeletes a domain association for an Amplify app. · --app-id --domain-name
delete-jobDeletes a job for a branch of an Amplify app. · --app-id --branch-name --job-id
delete-webhookDeletes a webhook. · --webhook-id
generate-access-logsReturns the website access logs for a specific time range using a presigned URL. · --domain-name --app-id
get-appReturns an existing Amplify app specified by an app ID. · --app-id
get-artifact-urlReturns the artifact info that corresponds to an artifact id. · --artifact-id
get-backend-environmentReturns a backend environment for an Amplify app · --app-id --environment-name
get-branchReturns a branch for an Amplify app. · --app-id --branch-name
get-domain-associationReturns the domain information for an Amplify app. · --app-id --domain-name
get-jobReturns a job for a branch of an Amplify app. · --app-id --branch-name --job-id
get-webhookReturns the webhook information that corresponds to a specified webhook ID. · --webhook-id
list-appsReturns a list of the existing Amplify apps.
list-artifactsReturns a list of end-to-end testing artifacts for a specified app, branch, and job · --app-id --branch-name --job-id
list-backend-environmentsLists the backend environments for an Amplify app · --app-id
list-branchesLists the branches of an Amplify app. · --app-id
list-domain-associationsReturns the domain associations for an Amplify app. · --app-id
list-jobsLists the jobs for a branch of an Amplify app. · --app-id --branch-name
list-tags-for-resourceReturns a list of tags for a specified Amazon Resource Name (ARN). · --resource-arn
list-webhooksReturns a list of webhooks for an Amplify app. · --app-id
start-deploymentStarts a deployment for a manually deployed app · --app-id --branch-name
start-jobStarts a new job for a branch of an Amplify app. · --app-id --branch-name --job-type
stop-jobStops a job that is in progress for a branch of an Amplify app. · --app-id --branch-name --job-id
tag-resourceTags the resource with a tag key and value. · --resource-arn --tags
untag-resourceUntags a resource with a specified Amazon Resource Name (ARN). · --resource-arn --tag-keys
update-appUpdates an existing Amplify app. · --app-id
update-branchUpdates a branch for an Amplify app. · --app-id --branch-name
update-domain-associationCreates a new domain association for an Amplify app. · --app-id --domain-name
update-webhookUpdates a webhook. · --webhook-id