Installing the AWS Command Line Interface
The primary distribution method for the AWS CLI on Linux, Windows, and macOS is pip
, a package manager for Python that provides an easy way to install, upgrade, and remove Python packages and their dependencies.
Current AWS CLI Version
The AWS CLI is updated frequently with support for new services and commands. To see if you have the latest version, see the releases page on GitHub.
Requirements
- Python 2 version 2.6.5+ or Python 3 version 3.3+
- Windows, Linux, macOS, or Unix
Note
Older versions of Python may not work with all AWS services. If you seeInsecurePlatformWarning
or deprecation notices when you install or use the AWS CLI, update to a recent version.
If you already have pip
and a supported version of Python, you can install the AWS CLI with the following command:
$ pip install awscli --upgrade --user
The --upgrade
option tells pip
to upgrade any requirements that are already installed. The --user
option tells pip
to install the program to a subdirectory of your user directory to avoid modifying libraries used by your operating system.
If you encounter issues when you attempt to install the AWS CLI with pip
, you can install the AWS CLI in a virtual environment to isolate the tool and its dependencies, or use a different version of Python than you normally do.
Standalone Installers
For offline or automated installations on Linux, macOS, or Unix, try the bundled installer. The bundled installer includes the AWS CLI, its dependencies, and a shell script that performs the installation for you.
On Windows, you can also use the MSI installer. Both of these methods simplify the initial installation, with the tradeoff of being more difficult to upgrade when a new version of the AWS CLI is released.
After you install the AWS CLI, you may need to add the path to the executable file to your PATH variable. For platform specific instructions, see the following topics:
Verify that the AWS CLI installed correctly by running aws --version
.
$ aws --version
aws-cli/1.11.84 Python/3.6.2 Linux/4.4.0-59-generic botocore/1.5.47
The AWS CLI is updated regularly to add support for new services and commands. To update to the latest version of the AWS CLI, run the installation command again.
$ pip install awscli --upgrade --user
If you need to uninstall the AWS CLI, use pip uninstall
.
$ pip uninstall awscli
If you don’t have Python and pip
, use the procedure for your operating system:
Sections
- Install the AWS Command Line Interface on Linux
- Install the AWS Command Line Interface on Microsoft Windows
- Install the AWS Command Line Interface on macOS
- Install the AWS Command Line Interface in a Virtual Environment
- Install the AWS CLI Using the Bundled Installer (Linux, macOS, or Unix)
Configuring the AWS CLI
This section explains how to configure settings that the AWS Command Line Interface uses when interacting with AWS, such as your security credentials and the default region.
Note
The AWS CLI signs requests on your behalf, and includes a date in the signature. Ensure that your computer’s date and time are set correctly; if not, the date in the signature may not match the date of the request, and AWS rejects the request.
Sections
Quick Configuration
For general use, the aws configure
command is the fastest way to set up your AWS CLI installation.
$ aws configure
AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-west-2
Default output format [None]: json
The AWS CLI will prompt you for four pieces of information. AWS Access Key ID and AWS Secret Access Key are your account credentials.
To get the access key ID and secret access key for an IAM user
Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. If you don’t have access keys, you can create them from the AWS Management Console. We recommend that you use IAM access keys instead of AWS account root user access keys. IAM lets you securely control access to AWS services and resources in your AWS account.
The only time that you can view or download the secret access keys is when you create the keys. You cannot recover them later. However, you can create new access keys at any time. You must also have permissions to perform the required IAM actions. For more information, see Delegating Permissions to Administer IAM Users, Groups, and Credentials in the IAM User Guide.
- Open the IAM console.
- In the navigation pane of the console, choose Users.
- Choose your IAM user name (not the check box).
- Choose the Security credentials tab and then choose Create access key.
- To see the new access key, choose Show. Your credentials will look something like this:
- Access key ID: AKIAIOSFODNN7EXAMPLE
- Secret access key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
- To download the key pair, choose Download .csv file. Store the keys in a secure location.Keep the keys confidential in order to protect your account, and never email them. Do not share them outside your organization, even if an inquiry appears to come from AWS or Amazon.com. No one who legitimately represents Amazon will ever ask you for your secret key.
Related topics
- What Is IAM? in the IAM User Guide
- AWS Security Credentials in AWS General Reference
Default region is the name of the region you want to make calls against by default. This is usually the region closest to you, but it can be any region. For example, type us-west-2
to use US West (Oregon).
Note
You must specify an AWS region when using the AWS CLI. For a list of services and available regions, see Regions and Endpoints. The region designators used by the AWS CLI are the same names that you see in AWS Management Console URLs and service endpoints.
Default output format can be either json
, text
, or table
. If you don’t specify an output format, json
is used.
If you have multiple profiles, you can configure additional, named profiles by using the --profile
option.
$ aws configure --profile user2
AWS Access Key ID [None]: AKIAI44QH8DHBEXAMPLE
AWS Secret Access Key [None]: je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
Default region name [None]: us-east-1
Default output format [None]: text
To update any of your settings, simply run aws configure
again and enter new values as appropriate. The next sections contain more information on the files that aws configure
creates, additional settings, and named profiles.
Configuration Settings and Precedence
The AWS CLI uses a provider chain to look for AWS credentials in a number of different places, including system or user environment variables and local AWS configuration files.
The AWS CLI looks for credentials and configuration settings in the following order:
- Command line options – region, output format and profile can be specified as command options to override default settings.
- Environment variables –
AWS_ACCESS_KEY_ID
,AWS_SECRET_ACCESS_KEY
, andAWS_SESSION_TOKEN
. - The AWS credentials file – located at
~/.aws/credentials
on Linux, macOS, or Unix, or atC:Users
on Windows. This file can contain multiple named profiles in addition to a default profile.USERNAME
.awscredentials - The CLI configuration file – typically located at
~/.aws/config
on Linux, macOS, or Unix, or atC:Users
on Windows. This file can contain a default profile, named profiles, and CLI specific configuration parameters for each.USERNAME
.awsconfig - Container credentials – provided by Amazon EC2 Container Service on container instances when you assign a role to your task.
- Instance profile credentials – these credentials can be used on EC2 instances with an assigned instance role, and are delivered through the Amazon EC2 metadata service.