AWS CLI, SDKs, and APIs

What we're doing: List running instance IDs only, instead of the full describe-instances response.

aws ec2 describe-instances \
  --query "Reservations[].Instances[?State.Name=='running'].InstanceId[]" \
  --output text

2

The JMESPath filter [?State.Name=='running'] runs client-side, after AWS returns every instance regardless of state.

Why this works: describe-instances returns a deeply nested structure — Reservations containing Instances — that is rarely useful to read as-is. --query reshapes it into exactly the list a script needs, without a separate parsing step.

What we're doing: Compare hand-rolled pagination against a paginator for the same list operation.

# manual pagination
token = None
keys = []
while True:
    kwargs = {"Bucket": "my-bucket"}
    if token:
        kwargs["ContinuationToken"] = token
    resp = client.list_objects_v2(**kwargs)
    keys += [o["Key"] for o in resp.get("Contents", [])]
    if not resp.get("IsTruncated"):
        break
    token = resp["NextContinuationToken"]

# with a paginator
paginator = client.get_paginator("list_objects_v2")
keys = [o["Key"] for page in paginator.paginate(Bucket="my-bucket") for o in page.get("Contents", [])]

6

ContinuationToken must be tracked and conditionally passed by hand — easy to get wrong on the first page.

8

IsTruncated has to be checked every loop, or the last page silently gets dropped or the loop never ends.

Why this works: Every list-style AWS API paginates the same way in principle but with slightly different field names per service — a paginator hides that inconsistency instead of every caller re-deriving it.

What we're doing: Distinguish a quota error from a permissions error by reading the actual error code, not just "it failed."

{
  "Error": {
    "Code": "VcpuLimitExceeded",
    "Message": "You have requested more vCPU capacity than your current vCPU limit of 32 allows..."
  }
}

2

The error Code identifies exactly what kind of failure this is — here, a quota, not a permissions or validation problem.

3

The Message states the current limit explicitly (32 vCPUs) — enough to file a targeted Service Quotas increase request.

Why this works: A quota error and an IAM permissions error can both surface in the console as a generic red banner — the underlying API error Code and Message name the actual cause precisely, and quota errors specifically point at Service Quotas, not IAM.

What we're doing: Compare a one-off console action against the same action automated, and see what the automated version gains.

aws s3api create-bucket --bucket my-app-uploads --region eu-west-1 \
  --create-bucket-configuration LocationConstraint=eu-west-1
aws s3api put-bucket-encryption --bucket my-app-uploads \
  --server-side-encryption-configuration file://sse-config.json
aws s3api put-public-access-block --bucket my-app-uploads \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

1

Every setting this bucket needs is explicit in the script — nothing depends on someone remembering to also check three boxes in the console.

3

Encryption and public-access blocking are guaranteed identical the next time this script runs, for a second bucket, a year later.

Why this works: A script committed to source control is reviewable before it runs and reproducible after — a sequence of console clicks is neither, and is easy to do slightly differently the second time without noticing.