AWS CLI

What it is

The AWS Command Line Interface (AWS CLI) is an open source tool for working with AWS services through commands in your terminal, on Linux, macOS, or Windows. With little setup, it does what the console does, and because commands can be scripted, it is the usual way to automate tasks. AWS CLI version 2 is the current major version; install it only from official AWS sources.

Choose the CLI when a question involves scripting or automating AWS tasks from a terminal, or running commands from build servers and instances. In the browser, AWS CloudShell gives you the CLI already installed and signed in.

Configuration

Settings and credentials are stored in configuration and credential files, divided into profiles. Use --profile (or the AWS_PROFILE variable) to choose one.
Environment variables such as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and AWS_REGION override settings in the files. Command-line options override both.
Output formats: json, yaml, yaml-stream, text, table, and off. Use --query to filter output.

Authentication, in order of AWS's recommendation

Console credentials: aws login uses your AWS Management Console sign-in to get temporary credentials for the CLI and SDK (Software development kit)A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.Glossary entry, with no long-term access keys.
IAM Identity Center: aws configure sso creates a profile for an account and permission set, and aws sso login signs in. The CLI then gets short-term credentials from IAM Identity Center, so no long-term access keys are stored on the laptop, and users reuse their existing sign-in across accounts. AWS recommends Organizations with IAM Identity Center.
Short-term IAM user credentials, which expire quickly if leaked.
On EC2 instances, use an IAM role through the instance profile. On other compute, use the service's role, such as a Lambda execution role or an ECS task role. Never store access keys on instances.
Long-term access keys are the least preferred option.

Assuming a role: a profile with role_arn and source_profile makes the CLI call STS to assume the role automatically, for example to work in another account.

Security and cost

Prefer temporary credentials (console login, Identity Center, roles) over long-term keys, and never commit keys to code repositories.
Every CLI command is an API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry call recorded by CloudTrail.
The CLI is free; you pay for the resources you use.

CLI or another option?

If the requirement is	Choose
Script AWS tasks from a terminal	AWS CLI
CLI with nothing to install	AWS CloudShell
Call AWS from application code	AWS SDKs
Credentials for software on an EC2 instance	Instance profile role, not access keys
Repeatable infrastructure deployments	AWS CloudFormation

Reverse mindmap: when the question points here

Is it the AWS CLI?

Yes, when the question says
- Automate AWS tasks with scripts leads to AWS CLI
- Run commands from a build server leads to AWS CLI with a role
Configure it
- Several accounts or roles leads to Named profiles
- Work in another account leads to Profile with role_arn and source_profile
- Sign in without access keys leads to aws login or aws configure sso
- Override settings in a pipeline leads to Environment variables
Secure it
- CLI on an EC2 instance leads to Instance profile role
- Leaked access keys risk leads to Temporary credentials
- Remove access keys from developer laptops, Identity Center in use leads to aws configure sso
No, when the question says
- CLI in the browser leads to CloudShell

Key takeaways

The AWS CLI is an open source tool for scripting AWS from a terminal; version 2 is current.
Profiles in the config and credential files hold settings; environment variables override them.
Prefer temporary credentials: aws login with console credentials, IAM Identity Center, or roles; avoid long-term keys.
Profiles can assume roles with role_arn and source_profile.
Output can be JSON (JavaScript Object Notation)A text format for structured data made of name-and-value pairs and lists, such as {"bucket": "logs"}. IAM policies, most AWS API responses, and many CloudFormation templates are written in JSON.Glossary entry, YAML, text, or table, filtered with --query.