How to Install and Configure the AWS CLI on Linux

Clicking through the AWS console works for a one-off task, but the moment you manage instances, buckets, or DNS records regularly, you want those actions in your shell history and your scripts. The AWS CLI puts every AWS API behind a single aws command, so listing instances, syncing a bucket, or rotating a key becomes a one-liner you can repeat and automate.

This guide explains how to install AWS CLI version 2 on Linux, authenticate with short-term credentials, manage named profiles, and verify that your setup can access your AWS account.

Installing AWS CLI Version 2 #

AWS maintains an install script that downloads, verifies, and installs the current AWS CLI release. It detects whether your Linux system uses an x86_64 or ARM processor, so the same command works on both architectures:

curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bash

The script installs the program for your user under ~/.local/share/aws-cli and creates ~/.local/bin/aws. This avoids requiring root access. Open a new terminal after installation, then verify the version:

aws --version

The first part of the output should begin with aws-cli/2.. The remaining version and system details depend on the current release and your Linux distribution.

To install the CLI for every user instead, run the installer in system mode:

curl -fsSL https://awscli.amazonaws.com/v2/install.sh | sudo bash -s -- --system

System mode installs the files under /usr/local/aws-cli and creates the command links in /usr/local/bin.

When a newer release is available, update a per-user installation with:

aws update

Use sudo aws update if you installed the CLI in system mode.

Configuring AWS CLI Authentication #

AWS recommends short-term credentials for people and workloads. The best configuration method depends on how your AWS account manages identities:

• Use aws login when you already sign in to the AWS Management Console with an IAM or federated identity.
• Use aws configure sso when your organization uses AWS IAM Identity Center.
• Use aws configure with an IAM access key only when neither short-term method is available.

Do not configure the CLI with root-user access keys. Use a non-root identity with only the permissions required for your work.

Signing In with AWS Console Credentials #

AWS CLI version 2.32.0 and later supports aws login , which exchanges an existing console session for temporary credentials. Your AWS administrator must allow local developer sign-in for the identity. Start the browser-based flow with:

aws login

The CLI asks for a default Region if one is not already configured, then opens your browser. Select the console session and identity you want to use. AWS stores the temporary session under ~/.aws/login/cache and refreshes its credentials while the session remains valid.

To create or sign in to a named profile, add --profile:

aws login --profile work

On a remote Linux server without a browser, use the cross-device flow:

aws login --remote

When the session reaches its maximum duration, run aws login again. You can end it earlier with aws logout.

Configuring IAM Identity Center #

If your organization provides an AWS access portal, follow the IAM Identity Center configuration instead of using aws login. Run the setup wizard with a descriptive profile name:

aws configure sso --profile work

The wizard asks for the SSO session name, start or issuer URL, SSO Region, account, permission set, default Region, and output format. It opens a browser so you can authorize the session.

Sign in again whenever the SSO session expires:

aws sso login --profile work

IAM Identity Center stores the profile settings in ~/.aws/config and caches its tokens under ~/.aws/sso/cache.

Configuring an IAM Access Key #

Some legacy tools and workloads still require a long-term access key. If you cannot use temporary credentials, create the key for a dedicated IAM user with least-privilege permissions, then configure a named profile:

aws configure --profile legacy

AWS Access Key ID [None]: <your-access-key-id>
AWS Secret Access Key [None]: <your-secret-access-key>
Default region name [None]: eu-central-1
Default output format [None]: json

Choose the Region where most of your resources run. JSON is a practical default output format for scripts, while table is easier to scan interactively.

The CLI writes access keys to ~/.aws/credentials and other settings to ~/.aws/config.

Verifying the Configuration #

Ask AWS Security Token Service which identity the CLI resolved:

aws sts get-caller-identity

{
    "UserId": "AROAXAMPLE:dejan",
    "Account": "123456789012",
    "Arn": "arn:aws:sts::123456789012:assumed-role/Developer/dejan"
}

The response identifies the account, IAM user, or assumed role behind the current credentials. To test a named profile, add it to the command:

aws sts get-caller-identity --profile work

If the call succeeds, authentication works. Individual service commands can still fail when the identity lacks permission for that action.

Working with Named Profiles #

Profiles keep settings and credentials for separate accounts or roles from interfering with each other. List the profiles currently available:

aws configure list-profiles

Select a profile for one command with --profile:

aws s3 ls --profile work

To use the same profile for the rest of the shell session, set AWS_PROFILE:

export AWS_PROFILE=work

The default profile is used when neither --profile nor AWS_PROFILE is set. A command-line --profile option overrides the environment variable.

On EC2 instances, ECS tasks, and other AWS compute services, attach an IAM role to the workload instead of storing access keys. For CI systems, use the platform’s OpenID Connect integration to assume an IAM role when available.

Running Your First Commands #

The CLI follows a aws <service> <operation> pattern. List your S3 buckets:

aws s3 ls

2025-11-02 14:11:20 backups-prod
2026-01-01 09:48:03 static-assets

List EC2 instances, trimmed down to the fields you care about with --query:

aws ec2 describe-instances \
    --query 'Reservations[].Instances[].{ID:InstanceId,Type:InstanceType,State:State.Name}' \
    --output table

-------------------------------------------------
|               DescribeInstances               |
+----------------------+-----------+------------+
|          ID          |   Type    |   State    |
+----------------------+-----------+------------+
|  i-0abcd1234ef567890 |  t3.small |  running   |
|  i-0fe9876543ba21001 |  t3.micro |  stopped   |
+----------------------+-----------+------------+

The --query option takes a JMESPath expression and works on every command, which saves you from piping JSON into other tools for simple filtering. The --output option switches between json, yaml, text, and table per invocation.

Every service has built-in help, so aws s3 help and aws ec2 describe-instances help open the relevant manual pages without leaving the terminal.

Enabling Command Completion #

The installer includes aws_completer, which suggests services, operations, and options when you press Tab. Confirm that your shell can find it:

command -v aws_completer

The path is usually ~/.local/bin/aws_completer for a per-user installation or /usr/local/bin/aws_completer for a system installation.

For Bash, add this line to ~/.bashrc:

complete -C "$(command -v aws_completer)" aws

Reload the file:

source ~/.bashrc

For Zsh, add these lines to ~/.zshrc:

autoload bashcompinit && bashcompinit
complete -C "$(command -v aws_completer)" aws

Then reload the Zsh configuration:

source ~/.zshrc

Troubleshooting #

aws: command not found
For a per-user installation, ~/.local/bin may be missing from PATH. Add export PATH="$HOME/.local/bin:$PATH" to ~/.bashrc or ~/.zshrc, reload the file, and run aws --version again. For a system installation, check that /usr/local/bin is in PATH.

Unable to locate credentials
No authentication method is configured, or AWS_PROFILE points to a profile that does not exist. Run aws configure list to see where the CLI is looking and what it found.

ExpiredToken after aws login
An older access key in ~/.aws/credentials can take precedence over login credentials for the same profile. Run aws configure list, remove the stale key entries for that profile, and sign in again.

An error occurred (InvalidClientTokenId)
For an access-key profile, the key is inactive, deleted, or mistyped. Replace it in IAM and run aws configure --profile <profile-name> again.

An error occurred (UnauthorizedOperation) or AccessDenied
The credentials are valid, but the current identity lacks permission for that action. Ask your AWS administrator to grant the required permission through the relevant role, permission set, or IAM policy.

Could not connect to the endpoint URL
Check the configured Region with aws configure get region. A value such as eu-central1 is invalid; the correct format is eu-central-1.

Conclusion #

With AWS CLI version 2 installed and aws sts get-caller-identity returning the expected account, you can start using service commands without storing long-lived credentials. For recurring S3 syncs or instance reports, see our guide on using cron to schedule jobs .

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page