CLI官网开源GitHub17.3K Star4.7K Fork、纯Python实现、用于管理AWS产品的统一工具使用命令行控制多个AWS产品并利用脚本来自动执行这些服务。技巧命令补全AWS CLI v2支持Tab键补全命令和参数自动提示输入aws时可获得命令和参数建议历史记录使用aws history list和aws history show查看执行记录S3文件夹概念S3并无真实文件夹路径结构由对象前缀模拟实战支持超多种安装方式。因为是纯Python实现当然支持通过pip安装pipinstallawscliUnix类系统也可通过包管理器安装apt-getinstallawscli对于macOS而言通过cURL命令curl https://awscli.amazonaws.com/AWSCLIV2.pkg -o AWSCLIV2.pkg下载得到.pkg文件双击安装验证安装是否成功aws--version# 输出aws-cli/2.36.49 Python/3.14.6 Darwin/24.4.0 exe/x86_64命令行安装成功后如何使用才是关键。执行任何AWS命令行都需要有终端下的登录态信息默认从~/.aws/credentials文件读取。执行aws login命令会打开浏览器手动输入用户名密码登录成功后会将登录态信息写入到该文件。这是一个纯文本文件内容示例[default]aws_access_key_idASIA111111ILTF72 aws_secret_access_keyltrIXg2222222mgs333gIKKWB aws_session_tokenIQoJb3JpZ2luX2VjEGYaDmNuLW5vcnRod2VzdC0xIkcwRQIgM8F4s2JtuLS7Srjk7seFKxrN2XpHRxReQfXaUeoCIQDHrxqzibRDf3TQPmZPDx/6wVtlmdbuhBaqfh7s8ZWzsPu68pUmKJzWWndi0vxJv7RM0odgg3/n9a2OOgAQ1gVCQBWmj4vhU6SS158wmKhlUjhlOG49N4vWz0KbVzXf4既然如此也支持手动编辑此文件。如何获取这3个数据呢打开浏览器开发者调试工具如Chrome浏览器快捷键F12登录AWS控制台找到接口browserCreds如https://cn-northwest-1.console.amazonaws.cn/api/prod/browserCreds查看该接口的响应{accessKeyId:ASIA111111ILTF72,secretAccessKey:ltrIXg2222222mgs333gIKKWB,sessionToken:IQoJb3JpZ2luX2VjEGYaDmNuLW5vcnRod2VzdC0xIkcwRQIgM8F4s2JtuLS7Srjk7seFKxrN2XpHRxReQfXaUeoCIQDHrxqzibRDf3TQPmZPDx/6wVtlmdbuhBaqfh7s8ZWzsPu68pUmKJzWWndi0vxJv7RM0odgg3/n9a2OOgAQ1gVCQBWmj4vhU6SS158wmKhlUjhlOG49N4vWz0KbVzXf4,expiration:2026-09-23T09:27:07.000Z}accessKeyId和secretAccessKey应该是固定不变变更的数据是sessionToken。sessionToken默认有效期是24小时24h内可反复执行aws命令行24h后执行绝大多数命令会报错提示aws: [ERROR]: An error occurred (ExpiredToken) when calling the ListBuckets operation: The provided token has expired.需重新执行aws login命令登录更新~/.aws/credentials文件。当然不是所有的命令行都依赖于~/.aws/credentials文件如执行aws configure list命令是读取配置列表。执行aws configure set region cn-northwest-1命令会往~/.aws/config文件写入配置项信息即KV对aws configure list命令实际上就是从~/.aws/config和~/.aws/credentials文件读取KV对~/.aws/config纯文本文件示例[sso-session d-1111] sso_start_urlhttps://d-1111.awsapps.com/start sso_regioneu-west-2 sso_registration_scopescodewhisperer:conversations,codewhisperer:transformations,codewhisperer:taskassist,codewhisperer:completions,codewhisperer:analysis [default] region cn-northwest-1命令行使用示例aws login aws configure list aws configuresetregion cn-northwest-1# s3aws s3lsaws s3lss3:// aws s3lss3://bucket1/# 上传文件aws s3cp./file.txt s3://my-bucket/# 同步本地与 S3aws s3sync/home/ s3://ceshi/ecs-backup/$(date%Y-%m-%d)/--delete# 删除文件或目录aws s3rms3://my-bucket/file.txt aws s3rms3://my-bucket/folder/--recursive# 删除空存储桶aws s3 rb s3://my-bucket/# ecraws ecr get-login-password--regioneu-west-2.token# iam# 列出账户中的 OIDC Provideraws iam list-open-id-connect-providers# 检查特定 OIDC Provider 的 thumbprintaws iam get-open-id-connect-provider\--open-id-connect-provider-arnarn:aws-cn:iam::069034308707:oidc-provider/oidc.eks.cn-northwest-1.amazonaws.com.cn/id/9EE8912AEA5717C75FBA19D701D24C46# 查看IAM Role的策略aws iam list-attached-role-policies\--role-name jlr-gdd-fta-vehicle-service-bridge-role\--regioncn-northwest-1# secretsmanageraws secretsmanager get-secret-value --secret-idarn:aws-cn:secretsmanager:cn-northwest-1:069034308707:secret:rds!cluster-41693547-4809-466d-84ff-42a7907909d2-3aCjbD--querySecretString--outputtext|jq-r.password# ec2# 检查是否有VPC Endpoint for STSaws ec2 describe-vpc-endpoints\--regioncn-northwest-1\--filtersNameservice-name,Valuescom.amazonaws.vpce.cn-northwest-1.sts# 检查VPC Endpoint的安全组aws ec2 describe-security-groups\--regioncn-northwest-1\--group-idssecurity-group-id-from-vpc-endpoint# stsaws sts get-caller-identity# eksaws eks describe-cluster--namecluster-name--regioncn-northwest-1|grep-A5-B5identity aws eks describe-cluster--namecn-dev--regioncn-northwest-1|grep-A5-B5identity# 查看集群OIDC提供商信息aws eks describe-cluster\--namecn-dev\--regioncn-northwest-1\--querycluster.identity.oidc.issuer注命令行示例后面会持续更新。awslocalLocalStack官方开源GitHub1.3K Star94 Fork、PythonShell实现、围绕aws命令行设计的轻量级包装器专为与LocalStack集成而生专门用来连接本地的LocalStack模拟环境。区别awslocal会自动把请求发送到本地而不用每次都手动指定地址。awsAWS官方命令行工具。默认情况下会去连接真正的AWS云。如果想让它去连接本地LocalStack需手动在每条命令后面加上--endpoint-urlhttp://localhost:4566参数或配置专门profile。awslocal轻量级的包装脚本thin wrapper。底层调用aws会自动把--endpoint-url指向本地LocalStack默认localhost:4566。特性aws(原生)awslocal(包装)默认目标真正的AWS云本地的LocalStack连接方式需要加--endpoint-url或配置profile自动指向localhost:4566命令语法aws s3 lsawslocal s3 ls(完全相同)安装方式官方安装包可通过pip install awscli-local安装例子用原生aws连接LocalStackaws --endpoint-urlhttp://localhost:4566 s3 ls用awslocal连接LocalStackawslocal s3 lsLocalStack推出新工具lstk整合awslocal、tflocal等功能。本身并不直接管理复杂的配置文件配置主要通过环境变量实现AWS_ENDPOINT_URL服务端点URL优先级高于下述两个选项LOCALSTACK_HOST已弃用定义LocalStack位置默认localhost:4566USE_SSL已弃用控制是否对连接到LocalStack使用SSL默认否对于更细致的配置如特定于某个服务的行为通常建议调整LocalStack本身的设置或利用AWS CLI的配置机制。可通过上述环境变量间接控制awslocal的行为确保它指向正确的LocalStack实例或其他自定义设置。源码目录结构概览awscli-local/ ├── github/workflows # GitHub Actions工作流相关配置文件 ├── bin # 可执行脚本所在目录 ├── output # 空目录 ├── tests/bin # 测试 ├── Makefile # 构建和自动化任务文件 ├── README.md # 主要的项目说明文件 ├── requirements.txt # 依赖包列表 ├── setup.py # 安装脚本解读bin包含awslocal入口脚本或相关辅助脚本requirements.txt列出项目运行所需的Python库setup.py用于通过pip安装此包裹的元数据和安装逻辑实战基于pip安装pip install awscli-local安装成功后可能会出现命令行无法使用的问题awslocal zsh: /Users/tssh/Library/Python/3.9/bin/awslocal: bad interpreter: /Library/Developer/CommandLineTools/usr/bin/python3: no suchfileor directory原因在于macOS下Python环境混乱问题之前安装过3.9后来安装3.13解决方法# 重新基于3.13安装python3-mpipinstall--upgrade--force-reinstall awscli-local# 删除3.9rm-fr~/Library/Python/3.9# 验证whichawslocal# 输出/Library/Frameworks/Python.framework/Versions/3.13/bin/awslocal执行awslocal命令输出aws:[ERROR]: An error occurred(ParamValidation): the following arguments are required:commandusage: aws[options]commandsubcommand[subcommand...][parameters]To seehelptext, you can run: awshelpawscommandhelpawscommandsubcommandhelp示例awslocal sqs create-queue --queue-name sample-queue awslocal s3api create-bucket--bucketrishi--regioncn-northwest-1 awslocal s3api list-buckets