AWS Command Line Interface (AWS CLI)

When multiple configuration sources are provided, the AWS CLI follows a specific order of precedence. Higher priority sources override lower ones.

General Configuration Precedence:

1. Command line options (e.g., --region)
2. Environment variables (e.g., AWS_DEFAULT_REGION)
3. Configuration file (~/.aws/config)

Credentials Precedence:

1. Environment variables (e.g., AWS_ACCESS_KEY_ID)
2. Shared credentials file (~/.aws/credentials)
3. AWS CLI config file (~/.aws/config)

Note: If AWS_PROFILE is set, environment variables like AWS_ACCESS_KEY_ID will override the credentials found within that specific profile.

When customizing your attributes.json file for get-instance-types-from-instance-requirements, you must provide values for ArchitectureTypes, VirtualizationTypes, VCpuCount, and MemoryMiB. Other attributes within the InstanceRequirements object can be omitted, in which case the service uses default values.

{
    "ArchitectureTypes": [
        "x86_64"
    ],
    "VirtualizationTypes": [
        "hvm"
    ],
    "InstanceRequirements": {
        "VCpuCount": {
            "Min": 4,
            "Max": 6
        },
        "MemoryMiB": {
            "Min": 2048
        },
        "InstanceGenerations": [
            "current"
        ]
    }
}

You can define multiple profiles in both the shared credentials file and the configuration file.

• To use a specific profile: Use the --profile option in your command.
• Default behavior: If no --profile is specified, the default profile is used.

Config File Syntax for Profiles: In the ~/.aws/config file, you must prefix profile section headers with profile:

[profile testing]
aws_access_key_id=<testing access key>
aws_secret_access_key=<testing secret key>
region=us-west-2

$ aws s3 ls --profile testing

The get-configuration command produces two distinct pieces of information:

1. The Configuration Content: This is the actual data defined in your profile. In the example provided, it is saved to the file specified at the end of the command (e.g., configuration-output-file). Example content:

   { "Name": "ExampleApplication", "Id": ExampleID, "Rank": 7 }

2. The Command Output: The CLI returns a JSON object containing metadata about the retrieved configuration, specifically the version and the content type. Example output:

   {
       "ConfigurationVersion": "1",
       "ContentType": "application/json"
   }

The AWS CLI attempts to verify the integrity of downloaded objects when possible.

If Amazon S3 returns a non-MD5 checksum with the downloaded object, the CLI will use that same algorithm to recalculate the checksum locally and verify it matches the checksum stored in S3.

Important Behavior:

• If checksum validation fails, the CLI raises an error.
• If validation fails, the request will NOT be retried.
• This applies to commands such as aws s3api get-object.

The package command treats the provided CloudFormation template as trusted build input.

Warning: Do not run aws cloudformation package against templates from untrusted sources. Because the command reads files from the local filesystem based on paths defined in the template (including relative paths that traverse above the template directory, e.g., CodeUri: ../src/my-function), a malicious template can be designed to read and upload sensitive files from your machine (such as credentials or private keys) to the configured S3 bucket.

The output of validate-policy is a JSON object containing a findings array. Each finding includes:

• findingDetails: A human-readable description of the issue.
• findingType: The severity/nature of the finding (e.g., SUGGESTION, ERROR).
• issueCode: A machine-readable code representing the specific check that failed (e.g., EMPTY_SID_VALUE, MISMATCHED_ACTION_FOR_PRINCIPAL, UNSUPPORTED_ACTION_FOR_CONDITION_KEY).
• learnMoreLink: A URL to the AWS documentation for more details on the specific check.
• locations: An array of objects describing the exact path and character span within the JSON document where the issue was detected.

To check if your current AWS CLI v1 installation is running on an unsupported or deprecated version of Python, run the aws --version command.

Examine the second portion of the output string (starting with Python/). If the version is lower than Python/3.10.x, you should upgrade to Python 3.10 or later to ensure continued support and security updates.

Note: AWS CLI v2 is not affected by this transition because it bundles its own copy of Python 3.

$ aws --version
aws-cli/1.18.191 Python/2.7.18 Darwin/19.6.0 botocore/1.19.31