Learn the AWS CLI command shape

Part 3 of AWS from Zero. Before creating resources, we need to learn how AWS CLI commands are shaped.

Almost every command follows this pattern:

aws <service> <operation> --option value

Examples:

aws s3api list-buckets
aws ec2 describe-regions
aws iam list-users

The nouns change, but the rhythm stays familiar.

Start with help

The CLI has built-in documentation:

aws help
aws ec2 help
aws ec2 describe-regions help

That last command is the most useful one. It shows the exact options, output shape, and examples for one operation.

If your terminal opens a pager, use:

q

to quit.

Read JSON like a map

Run:

aws ec2 describe-regions --output json

You will get a response shaped like this:

{
  "Regions": [
    {
      "Endpoint": "ec2.ap-south-1.amazonaws.com",
      "RegionName": "ap-south-1",
      "OptInStatus": "opt-in-not-required"
    }
  ]
}

The top-level key is Regions. Inside it is a list. Each item has fields like RegionName.

That shape matters because --query lets us select from it.

Use query to ask for less

Show only region names:

aws ec2 describe-regions \
  --query "Regions[].RegionName" \
  --output table

Show region names and endpoints:

aws ec2 describe-regions \
  --query "Regions[].{Name:RegionName,Endpoint:Endpoint}" \
  --output table

This query language is called JMESPath. You do not need to master it immediately. Start with selecting fields.

Use filters when the service supports them

Some commands support server-side filters. EC2 does:

aws ec2 describe-regions \
  --filters "Name=opt-in-status,Values=opt-in-not-required" \
  --query "Regions[].RegionName" \
  --output table

Think of it this way:

• --filters asks AWS to send less data.
• --query shapes the data after AWS sends it.

Dry run when available

Some EC2 commands support:

--dry-run

This checks whether you have permission without creating the resource. Not every AWS service supports it, but when it exists, use it.

First repeatable habit

For every new service, run these three commands:

aws <service> help
aws <service> list-... help
aws <service> describe-... help

You are not memorizing AWS. You are learning how to interrogate it.

In part 4, we step into IAM: users, roles, policies, and the identity model that controls everything else.