beginnerintermediateadvanced

AWS · CLI, SDKs, and APIs

AWS CLI, SDKs, and APIs

The console, CLI, and SDK are three doors onto the same underlying API — quotas, errors, and signing are shared

--profile + --queryselect credentials/region, then filter the response with JMESPath
Retries and pagination built inSDK clients back off and page automatically
Quotas are per-Regiona limit increase in one Region does not apply elsewhere
Repeated → automate itone-off actions are fine in the console; anything repeated is not

1.AWS CLI basics: profiles, regions, and JMESPath queries

The AWS CLI wraps every service API as a command. A named profile picks which credentials and region to use, and `--query` filters a large JSON response down to just the fields you need with JMESPath.

Key features

~/.aws/config holds regions and settings per profile; ~/.aws/credentials holds keys
--profile <name> or AWS_PROFILE selects which named profile to use
--region overrides the profile's default region for one call
--output can be json, yaml, text, or table
--query applies a JMESPath expression to filter the response client-side

Common AWS CLI flags

Common AWS CLI flags
Flag	Purpose
--profile <name>	Use a named profile's credentials and settings
--region <region>	Override the region for this call only
--output json\|yaml\|text\|table	Response format
--query <jmespath>	Filter/reshape the response before printing
--dry-run	Validate permissions and parameters without executing

One CLI call, four independent flags

aws ec2 describe-instances \ --profile staging --region eu-west-1 \ --query "Reservations[].Instances[].InstanceId" --output text

--profile staging

profile — which credentials and default settings to use

--region eu-west-1

region — overrides the profile's default region, this call only

--query "Reservations[].Instances[].InstanceId"

query — JMESPath — reshapes the response client-side

--output text

output — the response format

Command

text

aws <service> <operation> [--profile name] [--region region] [--query jmespath] [--output format]

--profile picks credentials and default region; --query (JMESPath) reshapes the response client-side — always safer to script against than text-output column position.

2.SDK clients: retries, paginators, and waiters

An AWS SDK client does three things behind the scenes on every call: signs the request with your credentials, retries it automatically on throttling or transient failure, and — for calls returning long lists — a paginator saves you from writing your own next-page loop.

Key features

Every request is signed using SigV4 before it leaves the client
Retries use exponential backoff, automatically, for throttling and transient errors
A paginator wraps a list-style call, yielding each page without manual NextToken handling
A waiter polls until a resource reaches a target state (e.g. instance running)
Region and credentials are resolved once per client, from the same provider chain the CLI uses

What a client call does before your code sees a result

Sign

SigV4, using resolved credentials

Send

to the resolved region

Retry

exponential backoff on throttling

Paginate

if the operation returns pages

Command

python

paginator = client.get_paginator("list_objects_v2")
for page in paginator.paginate(Bucket="my-bucket"):
    ...

SDK clients already sign, retry with backoff, and (via a paginator) page through long list results — reach for the paginator/waiter before hand-rolling the same loop.

3.Inspecting APIs, quotas, and error messages

Every AWS Console click maps to an underlying API call, and every account has numeric limits — service quotas — on how many of a resource it can create. Reading the actual API error and checking the quota beats guessing from the console alone.

Key features

Service Quotas is the console/API for viewing and requesting limit increases
A quota is per-account, per-Region — the same limit can differ Region to Region
The CLI/SDK surfaces the exact error code and message the console often summarizes away
--debug on the CLI shows the raw signed request and response
Many quotas can be raised via a Service Quotas request; some are hard limits

Command

bash

aws service-quotas get-service-quota --service-code ec2 --quota-code L-1216C47A

Read the API error Code and Message directly rather than a summarized console banner, and remember most quotas are per-Region, not account-wide.

4.Automation first for repeatable tasks

A console click that is never repeated is fine as a console click. A task done more than once — creating an environment, rotating a resource, running a routine check — should be a script or IaC template instead, so it runs the same way every time.

Key features

The console is fine for exploration and one-off, unrepeated actions
Anything done more than once should become a script, CLI command, or IaC template
A scripted action is reviewable (in a PR) before it runs; a console click is not
Automation is what makes an action repeatable identically across environments
Console-only changes drift silently out of sync with what infrastructure code describes

Command

text

Console click  →  did it once, correctly, this time
Script / CLI / IaC  →  does it the same way, every time, reviewably

A one-off console action is fine; anything repeated becomes a script, CLI command, or IaC template — reviewable before it runs, reproducible after.

Spotted a mistake on this page? Tell us.

Read Sheet