Aws Cli Beast

AWS CLI Beast Mode

Overview

Advanced AWS CLI patterns for speed, precision, and security-first automation. Covers JMESPath queries, bulk operations, waiters, cross-account access, and destructive operation safety.

When to Use

• Bulk operations across thousands of AWS resources
• Advanced JMESPath filtering and output transformation
• Automated scripts for AWS routines
• Multi-profile and multi-region management
• Security auditing and compliance checks
• CLI-driven infrastructure-as-code workflows

Instructions

Step 1: Categorize the Request

Step 2: Apply Beast Mode Principles

1. Dry-run first: Always validate with --dryrun or --dry-run 2. Query server-side: Use --query with JMESPath to filter before transfer 3. Batch intelligently: Paginate with --max-results and parallelize with xargs 4. Wait properly: Use built-in waiters or exponential backoff polling 5. Switch contexts: Use --profile and --region for multi-account operations

Step 3: Validate Destructive Operations

MANDATORY for any destructive operation:

# S3 sync with delete - MUST dry-run first
aws s3 sync s3://source/ s3://dest/ --delete --dryrun
# Review output, then remove --dryrun only if satisfied

# Bulk EC2 stop - validate targets first
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=development" \
  --query 'Reservations[].Instances[?State.Name==`running`].InstanceId' \
  --output text
# Confirm list, then pipe to stop command

# IAM policy attachment - simulate first
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/myuser \
  --action-names s3:DeleteObject \
  --resource-arns arn:aws:s3:::my-bucket/*

Step 4: Reference Detailed Guides

• compute-mastery.md - EC2, Lambda, Spot Fleets, ASG
• data-ops-beast.md - S3 multipart, DynamoDB batch, RDS snapshots
• networking-security-hardened.md - VPC Flow Logs, IAM policies, security groups
• automation-patterns.md - Shell aliases, JMESPath templates, CI/CD integration

Examples

Example 1: Bulk EC2 Stop

"Stop all development instances"

# 1. Dry-run: identify targets
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=development" \
           "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text

# 2. Confirm IDs, then execute
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=development" \
           "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text | xargs aws ec2 stop-instances --instance-ids

Example 2: S3 Migration with Encryption

"Migrate data between buckets with SSE"

# 1. Dry-run migration
aws s3 sync s3://source-bucket/ s3://dest-bucket/ \
  --sse AES256 \
  --storage-class GLACIER \
  --exclude "*.tmp" \
  --dryrun

# 2. Enable versioning on destination
aws s3api put-bucket-versioning \
  --bucket dest-bucket \
  --versioning-configuration Status=Enabled

# 3. Execute after review
aws s3 sync s3://source-bucket/ s3://dest-bucket/ \
  --sse AES256 \
  --storage-class GLACIER \
  --exclude "*.tmp"

Example 3: IAM Security Audit

"Find overprivileged IAM users"

aws iam list-users --query 'Users[].UserName' --output text | \
while read user; do
  echo "Checking $user..."
  aws iam simulate-principal-policy \
    --policy-source-arn "arn:aws:iam::123456789012:user/$user" \
    --action-names DeleteItem,DeleteTable,DeleteFunction \
    --resource-arns "*" \
    --query 'EvaluationResults[?EvalDecision==`allowed`]'
done

Example 4: Multi-Region Lambda Deployment

"Deploy Lambda to all regions"

for region in us-east-1 us-west-2 eu-west-1; do
  echo "Deploying to $region..."
  aws lambda update-function-code \
    --function-name my-function \
    --zip-file fileb://function.zip \
    --region $region \
    --publish
  aws lambda wait function-active \
    --function-name my-function \
    --region $region
done

Example 5: JMESPath Advanced Filtering

"Get running instances with specific tags as table"

aws ec2 describe-instances \
  --query 'Reservations[].Instances[?State.Name==`running`].[InstanceId,Tags[?Key==`Name`].Value[0]|[0],PrivateIpAddress]' \
  --output table

Best Practices

1. Use --output json for programmatic processing 2. Filter with JMESPath server-side before transfer 3. Implement retry logic with exponential backoff 4. Use waiters instead of manual polling loops 5. Tag all resources for cost allocation and automation 6. Separate dev/staging/prod with AWS profiles 7. Enable CloudTrail for audit compliance 8. Validate IAM policies with simulate-principal-policy before attachment 9. Use --dry-run on every state-modifying operation 10. Enable MFA for security-sensitive operations

Constraints and Warnings

Rate Limiting

• AWS API throttling applies; use --max-throttle and exponential backoff
• Check aws service-quotas for current limits

Pagination

• Default page size is variable; use --max-results for consistency
• Use --no-paginate with jq for full dataset processing

Destructive Operations

• S3 sync --delete: Irreversibly removes files not in source
• EC2 terminate-instances: Cannot be undone; validate instance IDs first
• IAM detach/policy: May break existing access; simulate before applying
• RDS delete-db-instance: Snapshots do not protect all scenarios; verify retention

Security

• Never commit AWS credentials; use aws configure or environment variables
• Rotate access keys regularly with aws iam create-access-key
• Use least-privilege: simulate before granting permissions

Automation Patterns

Shell Aliases and Functions

Common AWS Aliases

Add these to your .bashrc or .zshrc:

# EC2 aliases
alias ec2-list='aws ec2 describe-instances --query "Reservations[].Instances[].{Name:Tags[?Key==\`Name\`].Value|[0],Id:InstanceId,State:State.Name,Type:InstanceType}" --output table'
alias ec2-state='aws ec2 describe-instance-status --instance-ids'
alias ec2-ssh='aws ssm start-session --target'
alias ec2-logs='aws logs tail /aws/ec2/'

# S3 aliases
alias s3ls='aws s3 ls'
alias s3tree='aws s3 ls --recursive | awk "{print \$4}" | tree --noreport -d'
alias s3sync='aws s3 sync'

# Lambda aliases
alias lambda-list='aws lambda list-functions --query "Functions[].{Name:FunctionName,Runtime:Runtime,Memory:MemorySize}" --output table'
alias lambda-invoke='aws lambda invoke --log-type Tail'
alias lambda-logs='aws logs tail /aws/lambda/'

# IAM aliases
alias iam-users='aws iam list-users --query "Users[].{Name:UserName,Created:CreateDate}" --output table'
alias iam-roles='aws iam list-roles --query "Roles[].{Name:RoleName,Path:Path}" --output table'

# General aliases
alias whoami='aws sts get-caller-identity'
alias aws-profiles='cat ~/.aws/config | grep "\[profile" | sed "s/\[profile //" | sed "s/\]//"'
alias aws-region='aws configure get region'

Useful Functions

# Switch AWS profile
awsprof() {
  export AWS_PROFILE=$1
  echo "Switched to profile: $1"
}

# Get AWS resources by tag
aws-tag() {
  aws ec2 describe-tags --filters "Name=tag:$1,Values=$2" --query "Tags[].ResourceId" --output text
}

# Stop all instances in environment
stop-env() {
  aws ec2 describe-instances \
    --filters "Name=tag:Environment,Values=$1" "Name=instance-state-name,Values=running" \
    --query "Reservations[].Instances[].InstanceId" \
    --output text | xargs aws ec2 stop-instances --instance-ids
}

# Get costs for service
aws-costs() {
  aws ce get-cost-and-usage \
    --time-period Start=$(date -d "1 month ago" +%Y-%m-%d),End=$(date +%Y-%m-%d) \
    --metrics UnblendedCost \
    --granularity DAILY \
    --group-by Type=DIMENSION,Key=SERVICE \
    --query "ResultsByTime[].Groups[?Keys[0]=='$1'].{Date:TimePeriod.Start,Cost:Metrics.UnblendedCost.Amount}" \
    --output table
}

JMESPath Templates

Common JMESPath Queries

{
  "ec2_instances": "Reservations[].Instances[].{Id:InstanceId,Name:Tags[?Key==`Name`].Value|[0],Type:InstanceType,State:State.Name}",
  "s3_buckets": "Buckets[].{Name:Name,CreationDate:CreationDate}",
  "lambda_functions": "Functions[].{Name:FunctionName,Runtime:Runtime,Memory:MemorySize,Timeout:Timeout}",
  "iam_users": "Users[].{Name:UserName,Arn:Arn,Created:CreateDate}",
  "vpc_subnets": "Vpcs[].{Id:VpcId,Cidr:CidrBlock,DnsHostnames:DnsHostnamesEnabled,DnsSupport:DnsSupportEnabled}",
  "rds_instances": "DBInstances[].{Id:DBInstanceIdentifier,Engine:Engine,Class:DBInstanceClass,Status:DBInstanceStatus}",
  "cloudwatch_alarms": "MetricAlarms[].{Name:AlarmName,Metric:MetricName,Namespace:Namespace,State:StateValue}"
}

Complex JMESPath Examples

# Get EC2 with specific tag and filter by state
aws ec2 describe-instances \
  --query 'Reservations[].Instances[?Tags[?Key==`Environment` && Value==`production`] | [0] | {Name:Tags[?Key==`Name`].Value | [0], Id:InstanceId, State:State.Name}'

# Aggregate Lambda metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/Lambda \
  --metric-name Invocations \
  --dimensions Name=FunctionName,Value=* \
  --query 'Datapoints[].{Time:Timestamp,Count:Sum}'

# Get unused security groups
aws ec2 describe-security-groups \
  --query 'SecurityGroups[?length(Instances)==`0` && length(NetworkInterfaces)==`0`].{Id:GroupId,Name:GroupName}'

Automation Scripts

EC2 Fleet Management

#!/bin/bash
# manage-fleet.sh

ENV=$1
ACTION=$2

case $ACTION in
  start)
    IDS=$(aws ec2 describe-instances \
      --filters "Name=tag:Environment,Values=$ENV" "Name=instance-state-name,Values=stopped" \
      --query "Reservations[].Instances[].InstanceId" --output text)
    [ -n "$IDS" ] && aws ec2 start-instances --instance-ids $IDS
    ;;
  stop)
    IDS=$(aws ec2 describe-instances \
      --filters "Name=tag:Environment,Values=$ENV" "Name=instance-state-name,Values=running" \
      --query "Reservations[].Instances[].InstanceId" --output text)
    [ -n "$IDS" ] && aws ec2 stop-instances --instance-ids $IDS
    ;;
  status)
    aws ec2 describe-instances \
      --filters "Name=tag:Environment,Values=$ENV" \
      --query "Reservations[].Instances[].{Name:Tags[?Key==\`Name\`].Value|[0],Id:InstanceId,State:State.Name}" \
      --output table
    ;;
esac

S3 Backup Script

#!/bin/bash
# s3-backup.sh

SOURCE_BUCKET=$1
DEST_BUCKET=$2
DATE=$(date +%Y%m%d-%H%M%S)

echo "Starting backup from $SOURCE_BUCKET to $DEST_BUCKET"

# Sync with delete to ensure mirror
aws s3 sync s3://$SOURCE_BUCKET/ s3://$DEST_BUCKET/$DATE/ \
  --storage-class GLACIER \
  --exclude "*.tmp" \
  --exclude "*.log"

# Create lifecycle rule for old backups
aws s3api put-bucket-lifecycle-configuration \
  --bucket $DEST_BUCKET \
  --lifecycle-configuration '{
    "Rules": [{
      "ID": "ArchiveOldBackups",
      "Status": "Enabled",
      "Prefix": "",
      "Transitions": [
        {"Days": 30, "StorageClass": "GLACIER"},
        {"Days": 365, "StorageClass": "DEEP_ARCHIVE"}
      ]
    }]
  }'

echo "Backup completed: $DATE"

Cost Monitoring Script

#!/bin/bash
# cost-monitor.sh

START_DATE=$(date -d "1 day ago" +%Y-%m-%d)
END_DATE=$(date +%Y-%m-%d)

# Get daily costs by service
echo "=== Daily Costs by Service ==="
aws ce get-cost-and-usage \
  --time-period Start=$START_DATE,End=$END_DATE \
  --metrics UnblendedCost \
  --granularity DAILY \
  --group-by Type=DIMENSION,Key=SERVICE \
  --query 'ResultsByTime[0].Groups[].{Service:Keys[0],Cost:Metrics.UnblendedCost.Amount}' \
  --output table

# Get EC2 costs by instance
echo -e "\n=== EC2 Costs by Instance ==="
aws ce get-cost-and-usage \
  --time-period Start=$START_DATE,End=$END_DATE \
  --metrics UnblendedCost \
  --granularity DAILY \
  --filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon EC2"]}}' \
  --query 'ResultsByTime[].Groups[].{UsageType:Keys[0],Cost:Metrics.UnblendedCost.Amount}' \
  --output table

Lambda Deployment Script

#!/bin/bash
# deploy-lambda.sh

FUNCTION_NAME=$1
S3_BUCKET=$2
S3_KEY=$3

# Validate function exists
aws lambda get-function --function-name $FUNCTION_NAME > /dev/null 2>&1
if [ $? -ne 0 ]; then
  echo "Creating new function: $FUNCTION_NAME"
  aws lambda create-function \
    --function-name $FUNCTION_NAME \
    --runtime python3.9 \
    --role arn:aws:iam::123456789012:role/lambda-role \
    --handler lambda.handler \
    --zip-file fileb://function.zip
else
  echo "Updating existing function: $FUNCTION_NAME"
  aws lambda update-function-code \
    --function-name $FUNCTION_NAME \
    --s3-bucket $S3_BUCKET \
    --s3-key $S3_KEY \
    --publish
fi

# Wait for function to be active
echo "Waiting for function to be active..."
aws lambda wait function-active --function-name $FUNCTION_NAME

# Verify
aws lambda get-function-configuration --function-name $FUNCTION_NAME \
  --query '{State:State,Version:Version}' --output table

Parallel Operations

GNU Parallel Examples

# Start sessions on multiple instances
cat instances.txt | parallel -j 10 "aws ssm start-session --target {}"

# Copy files to multiple S3 buckets
cat buckets.txt | parallel -j 5 "aws s3 cp file.txt s3://{}/"

# Invoke Lambda functions in parallel
cat functions.txt | parallel -j 20 "aws lambda invoke --function-name {} response.json"

# Run commands on multiple instances
cat instances.txt | parallel -j 10 "aws ssm send-command --instance-ids {} --document-name AWS-RunShellScript --parameters commands=['uptime']"

xargs Examples

# Delete old snapshots in parallel
aws ec2 describe-snapshots \
  --owner-ids self \
  --query 'Snapshots[?StartTime<=`2024-01-01`].SnapshotId' \
  --output text | xargs -P 5 -I {} aws ec2 delete-snapshot --snapshot-id {}

# Tag resources in batch
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=development" \
  --query 'Reservations[].Instances[].InstanceId' \
  --output text | xargs -I {} aws ec2 create-tags --resources {} --tags "Key=Team,Value=DevOps"

Cron Jobs and Scheduling

Common Scheduled Tasks

# Stop development instances at 7 PM
0 19 * * 1-5 /home/user/scripts/stop-dev-instances.sh >> /var/log/aws-scheduler.log 2>&1

# Start development instances at 8 AM
0 8 * * 1-5 /home/user/scripts/start-dev-instances.sh >> /var/log/aws-scheduler.log 2>&1

# Daily cost report
0 8 * * * /home/user/scripts/cost-report.sh | mail -s "Daily AWS Costs" team@company.com

# Weekly backup verification
0 2 * * 0 /home/user/scripts/verify-backups.sh >> /var/log/backup-verify.log 2>&1

EventBridge Integration

# Create scheduled rule
aws events put-rule \
  --name daily-cost-report \
  --schedule-expression "cron(0 8 * * ? *)" \
  --state ENABLED

# Put targets
aws events put-targets \
  --rule daily-cost-report \
  --targets '[{"Id":"1","Arn":"arn:aws:states:us-east-1:123456789012:stateMachine:CostReportStateMachine","RoleArn":"arn:aws:iam::123456789012:role/events-role"}]'

CI/CD Integration

GitHub Actions Example

name: AWS Deployment

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Deploy Lambda
        run: |
          zip -r function.zip app.py requirements.txt
          aws lambda update-function-code \
            --function-name my-function \
            --zip-file fileb://function.zip \
            --publish

      - name: Run tests
        run: |
          aws lambda invoke \
            --function-name my-function \
            --payload '{"action":"test"}' \
            response.json
          cat response.json | jq '.statusCode'

Rate Limiting Handling

Retry Patterns

#!/bin/bash
# retry.sh

max_retries=5
retry_delay=1

retry_aws() {
  local cmd="$@"
  local attempt=1

  while [ $attempt -le $max_retries ]; do
    if eval "$cmd"; then
      return 0
    fi
    echo "Attempt $attempt failed, retrying in $retry_delay seconds..."
    sleep $retry_delay
    retry_delay=$((retry_delay * 2))
    attempt=$((attempt + 1))
  done

  echo "All $max_retries attempts failed"
  return 1
}

# Usage
retry_aws aws ec2 describe-instances

AWS CLI Configuration for Retry

# Configure in ~/.aws/config
[default]
region = us-east-1
retry_handler_options = retry_mode=adaptive,max_attempts=10

# Or use environment variables
export AWS_MAX_ATTEMPTS=10
export AWS_RETRY_MODE=adaptive

Best Practices

1. Always use `--dry-run` for destructive operations 2. Implement proper error handling in scripts 3. Use tags for resource identification and automation 4. Enable CloudTrail for audit compliance 5. Use least-privilege IAM policies for automation scripts 6. Implement retry logic with exponential backoff 7. Log all operations for troubleshooting 8. Use parallel processing for bulk operations 9. Schedule expensive operations during off-peak hours 10. Test in lower environments before production deployment

Compute Mastery: EC2 and Lambda

EC2 Advanced Patterns

Instance Management

List All Instances with Details

# Comprehensive instance listing with tags
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[{
    Id: InstanceId,
    Type: InstanceType,
    State: State.Name,
    PrivateIP: PrivateIpAddress,
    PublicIP: PublicIpAddress,
    Name: Tags[?Key==`Name`].Value | [0],
    Env: Tags[?Key==`Environment`].Value | [0],
    AZ: Placement.AvailabilityZone,
    Subnet: SubnetId,
    VpcId: VpcId
  }]' \
  --output table

Instance Lifecycle Operations

# Start instances with validation
aws ec2 describe-instances \
  --instance-ids i-1234567890abcdef0 \
  --query 'Reservations[0].Instances[0].State.Name'

aws ec2 start-instances --instance-ids i-1234567890abcdef0
aws ec2 wait instance-running --instance-ids i-1234567890abcdef0

# Graceful stop with shutdown script
aws ec2 stop-instances --instance-ids i-1234567890abcdef0 --force

# Reboot with wait
aws ec2 reboot-instances --instance-ids i-1234567890abcdef0
aws ec2 wait instance-status-ok --instance-ids i-1234567890abcdef0

Instance Metadata

# Get instance metadata
curl -s http://169.254.169.254/latest/meta-data/

# Get specific metadata
curl -s http://169.254.169.254/latest/meta-data/instance-id
curl -s http://169.254.169.254/latest/meta-data/ami-id
curl -s http://169.254.169.254/latest/meta-data/security-groups

# Get user data (if available)
curl -s http://169.254.169.254/latest/user-data/

Spot Instance Management

Request Spot Fleet

# Create spot fleet request
aws ec2 request-spot-fleet \
  --spot-fleet-request-config file://spot-config.json

# spot-config.json
# {
#   "SpotFleetRequestConfig": {
#     "AllocationStrategy": "lowestPrice",
#     "TargetCapacity": 10,
#     "LaunchSpecifications": [
#       {
#         "ImageId": "ami-0c55b159cbfafe1f0",
#         "InstanceType": "t3.medium",
#         "SubnetId": "subnet-12345678",
#         "IamFleetRole": "arn:aws:iam::123456789012:role/fleet-role"
#       }
#     ]
#   }
# }

Cancel Spot Requests

# Cancel spot requests
aws ec2 cancel-spot-fleet-requests \
  --spot-fleet-request-ids sfr-12345678-1234-1234-1234-123456789012 \
  --terminate-instances

Auto Scaling Groups

ASG Operations

# List ASGs with desired capacity
aws autoscaling describe-auto-scaling-groups \
  --query 'AutoScalingGroups[].[AutoScalingGroupName, MinSize, MaxSize, DesiredCapacity, AvailabilityZones[]]' \
  --output table

# Update ASG capacity
aws autoscaling update-auto-scaling-group \
  --auto-scaling-group-name my-asg \
  --min-size 2 \
  --max-size 10 \
  --desired-capacity 5

# Scale up immediately
aws autoscaling execute-policy \
  --auto-scaling-group-name my-asg \
  --policy-name scale-up-policy

Security Groups Management

List and Analyze Security Groups

# Get all security groups with rules
aws ec2 describe-security-groups \
  --query 'SecurityGroups[].{
    Name: GroupName,
    Id: GroupId,
    VPC: VpcId,
    Rules: IpPermissions
  }' \
  --output json > security-groups.json

# Find security groups with open SSH (port 22)
aws ec2 describe-security-groups \
  --query 'SecurityGroups[?length(IpPermissions[?to_string(to_int(FromPort))==`22`])>`0`]' \
  --output json

# Find security groups allowing all traffic
aws ec2 describe-security-groups \
  --query 'SecurityGroups[?length(IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]])>`0`]' \
  --output json

Elastic Block Store (EBS)

Volume Operations

# Create volume
aws ec2 create-volume \
  --size 100 \
  --availability-zone us-east-1a \
  --volume-type gp3 \
  --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=DataVolume}]'

# Attach volume
aws ec2 attach-volume \
  --volume-id vol-1234567890abcdef0 \
  --instance-id i-1234567890abcdef0 \
  --device /dev/sdf

# Create snapshot
aws ec2 create-snapshot \
  --volume-id vol-1234567890abcdef0 \
  --description "Backup $(date)"

# List snapshots by volume
aws ec2 describe-snapshots \
  --filters "Name=volume-id,Values=vol-1234567890abcdef0" \
  --query 'Snapshots[].{ID:SnapshotId,Time:StartTime,Size:VolumeSize,State:State}' \
  --output table

Lambda Advanced Patterns

Function Deployment

Deploy Function with Layers

# Create deployment package
zip -r function.zip app.py requirements.txt

# Update function code
aws lambda update-function-code \
  --function-name my-function \
  --zip-file fileb://function.zip \
  --publish

# Add layers
aws lambda update-function-configuration \
  --function-name my-function \
  --layers arn:aws:lambda:us-east-1:123456789012:layer:numpy:1 arn:aws:lambda:us-east-1:123456789012:layer:pandas:1

Function Configuration

# Update memory and timeout
aws lambda update-function-configuration \
  --function-name my-function \
  --memory-size 512 \
  --timeout 300 \
  --environment "Variables={ENV=production}"

# Set VPC configuration
aws lambda update-function-configuration \
  --function-name my-function \
  --vpc-config SubnetIds=subnet-12345678,subnet-87654321,SecurityGroupIds=sg-12345678

# Configure dead letter queue
aws lambda update-function-configuration \
  --function-name my-function \
  --dead-letter-config TargetArn=arn:aws:sqs:us-east-1:123456789012:my-dlq

Invocation Patterns

Synchronous Invocation

# Invoke and wait for response
aws lambda invoke \
  --function-name my-function \
  --payload '{"key": "value"}' \
  --log-type Tail \
  response.json

# Parse logs from response
cat response.json | jq -r '.LogResult' | base64 -d

Asynchronous Invocation

# Invoke asynchronously
aws lambda invoke \
  --function-name my-function \
  --invocation-type Event \
  --payload '{"event": "data"}' \
  /dev/null

# Check function state after async invoke
sleep 5
aws lambda get-function-concurrency --function-name my-function

Invocation with AWS SDK Payload

# Use payload as JSON file
aws lambda invoke \
  --function-name my-function \
  --payload file://event.json \
  response.json

Layer Management

Create and Publish Layer

# Create layer package
mkdir python/lib/python3.9/site-packages
pip install -r requirements.txt -t python/lib/python3.9/site-packages/
zip -r layer.zip python/

# Publish layer
aws lambda publish-layer-version \
  --layer-name my-layer \
  --zip-file fileb://layer.zip \
  --compatible-runtimes python3.9 python3.10 \
  --license-info "MIT" \
  --description "Common dependencies"

# List layer versions
aws lambda list-layer-versions --layer-name my-layer

CloudWatch Logs Integration

View Function Logs

# Get recent logs
aws logs filter-log-events \
  --log-group-name /aws/lambda/my-function \
  --start-time $(date -d "1 hour ago" +%s)000 \
  --query 'events[].message' \
  --output text | head -50

# Stream logs in real-time
aws logs tail /aws/lambda/my-function --follow

Aliases and Versions

Manage Versions

# Publish version
aws lambda publish-version \
  --function-name my-function \
  --description "Production release v1.0"

# Create alias
aws lambda create-alias \
  --function-name my-function \
  --name production \
  --function-version 1 \
  --description "Production alias"

# Update alias to new version
aws lambda update-alias \
  --function-name my-function \
  --name production \
  --function-version 2

Concurrency and Scaling

Configure Reserved Concurrency

# Set reserved concurrency
aws lambda put-function-concurrency \
  --function-name my-function \
  --reserved-concurrency 10

# Remove reserved concurrency
aws lambda delete-function-concurrency \
  --function-name my-function

# Get current concurrency
aws lambda get-function-concurrency \
  --function-name my-function

Cost Optimization

Analyze Lambda Costs

# Get Lambda invocation and duration metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/Lambda \
  --metric-name Invocations \
  --start-time $(date -d "30 days ago" -Iseconds) \
  --end-time $(date -Iseconds) \
  --period 86400 \
  --statistics Sum \
  --dimensions Name=FunctionName,Value=my-function

# Get duration metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/Lambda \
  --metric-name Duration \
  --start-time $(date -d "30 days ago" -Iseconds) \
  --end-time $(date -Iseconds) \
  --period 86400 \
  --statistics Average,Maximum \
  --dimensions Name=FunctionName,Value=my-function

EC2 and Lambda Best Practices

1. Use IAM roles instead of access keys for EC2 and Lambda 2. Enable VPC for Lambda functions requiring network isolation 3. Use provisioned concurrency for latency-sensitive applications 4. Implement proper error handling and dead letter queues 5. Monitor costs with CloudWatch metrics and cost allocation tags 6. Use lifecycle hooks for graceful ASG scaling operations 7. Enable termination protection for production instances 8. Use SSM Session Manager instead of SSH where possible

Data Operations Beast: S3, DynamoDB, RDS

S3 Advanced Patterns

Bulk Operations

S3 Sync Patterns

# Standard sync
aws s3 sync s3://source-bucket/ s3://dest-bucket/

# Sync with delete (removes files not in source)
aws s3 sync s3://source-bucket/ s3://dest-bucket/ --delete

# Sync with storage class
aws s3 sync ./data s3://my-bucket/ --storage-class STANDARD_IA

# Sync with encryption
aws s3 sync ./data s3://my-bucket/ --sse AES256

# Sync with metadata
aws s3 sync ./data s3://my-bucket/ --metadata "Cache-Control=max-age=3600"

Multipart Upload for Large Files

# Manual multipart upload
aws s3api create-multipart-upload \
  --bucket my-bucket \
  --key large-file.tar.gz

# Upload parts
aws s3api upload-part \
  --bucket my-bucket \
  --key large-file.tar.gz \
  --part-number 1 \
  --body part1.tar.gz \
  --upload-id "multipart-upload-id"

# Complete multipart upload
aws s3api complete-multipart-upload \
  --bucket my-bucket \
  --key large-file.tar.gz \
  --upload-id "multipart-upload-id" \
  --multipart-upload '{"Parts": [{"ETag": "part1-etag", "PartNumber": 1}]}'

S3 Batch Operations

# List all objects with pagination
aws s3api list-objects-v2 \
  --bucket my-bucket \
  --prefix logs/ \
  --page-size 1000

# Get all object versions
aws s3api list-object-versions \
  --bucket my-bucket \
  --prefix data/

# Delete objects in bulk
aws s3api delete-objects \
  --bucket my-bucket \
  --delete '{"Objects": [{"Key": "file1.txt"}, {"Key": "file2.txt"}]}'

# Use objects filter file for bulk delete
aws s3api delete-objects \
  --bucket my-bucket \
  --delete file://delete-objects.json

Lifecycle Policies

Configure Lifecycle Rules

# Put lifecycle configuration
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-bucket \
  --lifecycle-configuration file://lifecycle.json

# lifecycle.json
# {
#   "Rules": [
#     {
#       "ID": "ArchiveOldLogs",
#       "Status": "Enabled",
#       "Filter": {
#         "Prefix": "logs/"
#       },
#       "Transitions": [
#         {"Days": 30, "StorageClass": "STANDARD_IA"},
#         {"Days": 90, "StorageClass": "GLACIER"},
#         {"Days": 365, "StorageClass": "DEEP_ARCHIVE"}
#       ],
#       "Expiration": {"Days": 730}
#     },
#     {
#       "ID": "DeleteIncompleteUploads",
#       "Status": "Enabled",
#       "Filter": {
#         "Prefix": "uploads/"
#       },
#       "AbortIncompleteMultipartUpload": {"DaysAfterInitiation": 7}
#     }
#   ]
# }

Replication

Configure Cross-Region Replication

# Enable versioning first
aws s3api put-bucket-versioning \
  --bucket source-bucket \
  --versioning-configuration Status=Enabled

# Create IAM role for replication
aws iam create-role \
  --role-name s3-replication-role \
  --assume-role-policy-document file://trust-policy.json

# Attach replication policy
aws iam put-role-policy \
  --role-name s3-replication-role \
  --policy-name replication-policy \
  --policy-document file://replication-policy.json

# Configure replication
aws s3api put-bucket-replication \
  --bucket source-bucket \
  --replication-configuration file://replication.json

Security Auditing

Bucket Policy Operations

# Get bucket policy
aws s3api get-bucket-policy --bucket my-bucket --query Policy --output text | python3 -m json.tool

# Check public access
aws s3api get-public-access-block --bucket my-bucket

# Get bucket encryption
aws s3api get-bucket-encryption --bucket my-bucket

# List bucket ACL
aws s3api get-bucket-acl --bucket my-bucket

Presigned URLs

Generate Presigned URLs

# Presigned URL for download (1 hour)
aws s3 presign s3://my-bucket/file.txt --expires-in 3600

# Presigned URL for upload
aws s3 presign s3://my-bucket/upload.txt --expires-in 3600 --put

# Programmatic presigned URL
aws s3 presign s3://my-bucket/data.json --expires-in 86400

S3 Access Points

Manage Access Points

# Create access point
aws s3control create-access-point \
  --account-id 123456789012 \
  --name my-access-point \
  --bucket my-bucket

# Configure access point policy
aws s3control put-access-point-policy \
  --account-id 123456789012 \
  --name my-access-point \
  --policy file://ap-policy.json

DynamoDB Advanced Patterns

Query Operations

Advanced Queries

# Query with key condition
aws dynamodb query \
  --table-name users \
  --key-condition-expression "PK = :pk AND begins_with(SK, :sk)" \
  --expression-attribute-values '{"pk":{"S":"USER#123"},"sk":{"S":"ORDER#"}}'

# Query with filter
aws dynamodb query \
  --table-name products \
  --key-condition-expression "Category = :cat" \
  --filter-expression "Price > :minPrice" \
  --expression-attribute-values '{":cat":{"S":"Electronics"},":minPrice":{"N":"100"}}'

# Query with projection
aws dynamodb query \
  --table-name orders \
  --key-condition-expression "CustomerId = :cid" \
  --projection-expression "OrderId, OrderDate, TotalAmount" \
  --expression-attribute-values '{":cid":{"S":"CUST#456"}}'

Scan Operations

Efficient Scanning

# Parallel scan with segments
aws dynamodb scan \
  --table-name large-table \
  --segment 0 \
  --total-segments 4 \
  --output json

# Scan with filter
aws dynamodb scan \
  --table-name logs \
  --filter-expression "#t > :threshold" \
  --expression-attribute-names '{"#t":"timestamp"}' \
  --expression-attribute-values '{":threshold":{"N":"1640000000"}}'

# Scan with pagination
aws dynamodb scan \
  --table-name my-table \
  --page-size 100 \
  --max-items 1000

Batch Operations

Batch Get and Write

# Batch get item (up to 100 items)
aws dynamodb batch-get-item \
  --request-items '{
    "Table1": {
      "Keys": [{"PK":{"S":"A"}},{"PK":{"S":"B"}}],
      "ProjectionExpression": "PK, SK, Data"
    }
  }'

# Batch write (up to 25 items)
aws dynamodb batch-write-item \
  --request-items '{
    "Table1": [
      {"PutRequest": {"Item": {"PK":{"S":"A"},"Data":{"S":"Value"}}}},
      {"DeleteRequest": {"Key": {"PK":{"S":"B"}}}}
    ]
  }'

# Use items file for complex operations
aws dynamodb batch-write-item --request-items file://items.json

Time to Live (TTL)

Manage TTL

# Enable TTL on table
aws dynamodb update-time-to-live \
  --table-name sessions \
  --time-to-live-specification "Enabled=true, AttributeName=expiresAt"

# Check TTL status
aws dynamodb describe-time-to-live --table-name sessions

# Get expired items
aws dynamodb scan \
  --table-name sessions \
  --filter-expression "expiresAt < :now" \
  --expression-attribute-values '{":now":{"N":"1640000000"}}'

Global Tables

Manage Global Tables

# Create global table
aws dynamodb create-global-table \
  --global-table-name my-global-table \
  --replication-group RegionName=us-east-1

# Describe global table
aws dynamodb describe-global-table --global-table-name my-global-table

Backup and Restore

Backup Operations

# Create on-demand backup
aws dynamodb create-backup \
  --table-name my-table \
  --backup-name "backup-$(date +%Y%m%d)"

# List backups
aws dynamodb list-backups --table-name my-table

# Restore table
aws dynamodb restore-table-from-backup \
  --target-table-name my-table-restored \
  --backup-arn arn:aws:dynamodb:us-east-1:123456789012:table/my-table/backup/1234567890

RDS Advanced Patterns

Instance Management

Instance Operations

# Create RDS instance
aws rds create-db-instance \
  --db-instance-identifier my-db \
  --engine postgres \
  --db-instance-class db.t3.micro \
  --allocated-storage 20 \
  --master-username admin \
  --master-user-password 'SecurePassword123!' \
  --vpc-security-group-ids sg-12345678

# Modify instance
aws rds modify-db-instance \
  --db-instance-identifier my-db \
  --db-instance-class db.t3.small \
  --allocated-storage 50 \
  --apply-immediately

# Delete instance (create snapshot first)
aws rds delete-db-instance \
  --db-instance-identifier my-db \
  --skip-final-snapshot \
  --final-db-snapshot-name my-final-snapshot

Snapshot Management

Snapshot Operations

# Create snapshot
aws rds create-db-snapshot \
  --db-instance-identifier my-db \
  --db-snapshot-identifier "snapshot-$(date +%Y%m%d)"

# Copy snapshot
aws rds copy-db-snapshot \
  --source-db-snapshot-identifier arn:aws:rds:us-east-1:123456789012:snapshot:source \
  --target-db-snapshot-identifier target-snapshot \
  --kms-key-id alias/my-key

# Share snapshot
aws rds modify-db-snapshot-attribute \
  --db-snapshot-identifier my-snapshot \
  --attribute-name restore \
  --values-to-add '["123456789012", "all"]'

# List shared snapshots
aws rds describe-db-snapshots-shared-by --max-records 100

Parameter Groups

Parameter Group Management

# Create parameter group
aws rds create-db-parameter-group \
  --db-parameter-group-name my-pg \
  --db-parameter-group-family postgres14 \
  --description "Custom parameter group"

# Modify parameters
aws rds modify-db-parameter-group \
  --db-parameter-group-name my-pg \
  --parameters '[{"ParameterName":"max_connections","ParameterValue":"200","ApplyMethod":"immediate"}]'

# Reset parameters
aws rds reset-db-parameter-group \
  --db-parameter-group-name my-pg \
  --reset-all-parameters

Read Replicas

Manage Read Replicas

# Create read replica
aws rds create-db-instance-read-replica \
  --db-instance-identifier my-replica \
  --source-db-instance-identifier my-db \
  --availability-zone us-east-1a

# Promote read replica
aws rds promote-read-replica \
  --db-instance-identifier my-replica

# Monitor replica lag
aws rds describe-db-instances \
  --db-instance-identifier my-replica \
  --query 'DBInstances[0].ReadReplicaSourceDBInstanceIdentifier'

Multi-AZ Deployment

Configure Multi-AZ

# Modify for Multi-AZ
aws rds modify-db-instance \
  --db-instance-identifier my-db \
  --multi-az \
  --apply-immediately

# Failover to standby
aws rds failover-db-instance \
  --db-instance-identifier my-db

# Describe DB instances status
aws rds describe-db-instances \
  --query 'DBInstances[].{ID:DBInstanceIdentifier,Status:DBInstanceStatus,AZ:AvailabilityZone,MultiAZ:MultiAZ}'

Enhanced Monitoring

Enable Monitoring

# Enable enhanced monitoring
aws rds modify-db-instance \
  --db-instance-identifier my-db \
  --monitoring-interval 60 \
  --monitoring-role-arn arn:aws:iam::123456789012:role/rds-monitoring-role

# Get monitoring metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/RDS \
  --metric-name CPUUtilization \
  --start-time $(date -d "1 hour ago" -Iseconds) \
  --end-time $(date -Iseconds) \
  --period 300 \
  --statistics Average \
  --dimensions Name=DBInstanceIdentifier,Value=my-db

Performance Insights

Use Performance Insights

# Enable Performance Insights
aws rds modify-db-instance \
  --db-instance-identifier my-db \
  --enable-performance-insights \
  --performance-insights-kms-key-id alias/my-key

# Get performance insights metrics
aws pi get-resource-metrics \
  --service-type RDS \
  --identifier db-ABC123 \
  --metric-queries '[{"Metric":"os.cpuUtilization.user"}]'

Data Operations Best Practices

1. S3: Use appropriate storage classes, enable lifecycle policies, enable versioning 2. DynamoDB: Use on-demand capacity for unpredictable workloads, use GSIs for queries 3. RDS: Enable Multi-AZ for production, use read replicas for scaling 4. All: Implement proper backup strategies, enable encryption at rest 5. Monitoring: Use CloudWatch metrics and alarms for all data services 6. Security: Use IAM policies with least-privilege, enable VPC endpoints

Networking and Security Hardened

VPC Advanced Patterns

VPC Creation and Configuration

VPC and Subnet Operations

# Create VPC with CIDR block
aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=main-vpc}]'

# Enable DNS hostnames
aws ec2 modify-vpc-attribute \
  --vpc-id vpc-12345678 \
  --enable-dns-hostnames "Value=true"

# Enable DNS support
aws ec2 modify-vpc-attribute \
  --vpc-id vpc-12345678 \
  --enable-dns-support "Value=true"

# Create subnets
aws ec2 create-subnet \
  --vpc-id vpc-12345678 \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-subnet-1a}]'

aws ec2 create-subnet \
  --vpc-id vpc-12345678 \
  --cidr-block 10.0.2.0/24 \
  --availability-zone us-east-1b \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-subnet-1b}]'

Internet Gateway and NAT Gateway

Network Connectivity

# Create and attach Internet Gateway
aws ec2 create-internet-gateway \
  --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=main-igw}]'

aws ec2 attach-internet-gateway \
  --vpc-id vpc-12345678 \
  --internet-gateway-id igw-12345678

# Create NAT Gateway
aws ec2 create-nat-gateway \
  --subnet-id subnet-12345678 \
  --allocation-id eip-12345678

# Wait for NAT Gateway to be available
aws ec2 wait nat-gateway-available --nat-gateway-ids nat-12345678

# Update route table for private subnets
aws ec2 create-route \
  --route-table-id rtb-12345678 \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-12345678

Security Groups

Security Group Management

# Create security group
aws ec2 create-security-group \
  --group-name web-sg \
  --description "Security group for web servers" \
  --vpc-id vpc-12345678

# Add inbound rules
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0 \
  --description "HTTPS from anywhere"

aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0

# Add outbound rules
aws ec2 authorize-security-group-egress \
  --group-id sg-12345678 \
  --protocol -1 \
  --cidr 0.0.0.0/0

# Copy security group rules
aws ec2 describe-security-groups --group-ids sg-source > sg-rules.json
aws ec2 create-security-group --group-name new-sg --vpc-id vpc-new --description "Copied from source"
# Apply rules from sg-rules.json to new-sg

VPC Flow Logs

Monitor Network Traffic

# Create IAM role for flow logs
aws iam create-role \
  --role-name vpc-flow-logs-role \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"Service": "vpc-flow-logs.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }]
  }'

# Attach flow logs policy
aws iam put-role-policy \
  --role-name vpc-flow-logs-role \
  --policy-name flow-logs-policy \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
      "Resource": "arn:aws:logs:*:*:*"
    }]
  }'

# Create flow log
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-12345678 \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /aws/vpc/flow-logs \
  --deliver-logs-permission-role-arn arn:aws:iam::123456789012:role/vpc-flow-logs-role

# Query flow logs
aws logs filter-log-events \
  --log-group-name /aws/vpc/flow-logs \
  --filter-pattern "[version, account, eni, source, destination, srcport, dstport, protocol, packets, bytes]"

VPC Peering

Cross-VPC Connectivity

# Create VPC peering connection
aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-12345678 \
  --peer-vpc-id vpc-87654321

# Accept VPC peering connection
aws ec2 accept-vpc-peering-connection \
  --vpc-peering-connection-id pcx-12345678

# Update route tables for peering
aws ec2 create-route \
  --route-table-id rtb-12345678 \
  --destination-cidr-block 10.1.0.0/16 \
  --vpc-peering-connection-id pcx-12345678

# Enable DNS hostnames for peering
aws ec2 modify-vpc-peering-connection-options \
  --vpc-peering-connection-id pcx-12345678 \
  --requester-peering-connection-options '{"AllowDnsHostnamesFromRequesterVPC":true}'

Transit Gateway

Centralized Routing

# Create Transit Gateway
aws ec2 create-transit-gateway \
  --description "Main TGW" \
  --amazon-asn 64512

# Attach VPC to Transit Gateway
aws ec2 attach-transit-gateway-vpc-attachment \
  --transit-gateway-id tgw-12345678 \
  --vpc-id vpc-12345678 \
  --subnet-ids subnet-1 subnet-2

# Attach VPN to Transit Gateway
aws ec2 attach-vpn-gateway \
  --transit-gateway-id tgw-12345678 \
  --vpn-connection-id vpn-12345678

# Create Transit Gateway route table
aws ec2 create-transit-gateway-route-table \
  --transit-gateway-id tgw-12345678

# Add route
aws ec2 create-transit-gateway-route \
  --transit-gateway-route-table-id tgw-rtb-12345678 \
  --destination-cidr-block 10.0.0.0/16 \
  --transit-gateway-attachment-id tgw-attach-12345678

Route53 Operations

DNS Management

# Create hosted zone
aws route53 create-hosted-zone \
  --name example.com \
  --caller-reference "reference-$(date +%s)"

# Create record set
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890ABC \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "www.example.com",
        "Type": "A",
        "TTL": 300,
        "ResourceRecords": [{"Value": "1.2.3.4"}]
      }
    }]
  }'

# Create alias record
aws route53 change-resource-record-sets \
  --hosted-zone-id Z1234567890ABC \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "app.example.com",
        "Type": "A",
        "AliasTarget": {
          "HostedZoneId": "Z2FDTNDATAQYW2",
          "DNSName": "my-alb-1234567890.us-east-1.elb.amazonaws.com",
          "EvaluateTargetHealth": true
        }
      }
    }]
  }'

Health Checks

# Create health check
aws route53 create-health-check \
  --caller-reference "healthcheck-$(date +%s)" \
  --health-check-config '{
    "Type": "HTTPS",
    "FullyQualifiedDomainName": "example.com",
    "Port": 443,
    "ResourcePath": "/health",
    "RequestInterval": 10,
    "FailureThreshold": 3
  }'

# Get health check status
aws route53 get-health-check-status \
  --health-check-id abcdef12-3456-7890-abcd-ef1234567890

CloudFront Distribution

CDN Management

# Create distribution
aws cloudfront create-distribution \
  --origin-domain-name my-bucket.s3.amazonaws.com \
  --default-root-object index.html \
  --comment "Main distribution"

# Get distribution config
aws cloudfront get-distribution-config \
  --id EDFDVBD6EXAMPLE

# Update distribution
aws cloudfront update-distribution \
  --id EDFDVBD6EXAMPLE \
  --distribution-config file://dist-config.json \
  --if-match E2QWR3HEG8SAMPLE

# Create invalidation
aws cloudfront create-invalidation \
  --distribution-id EDFDVBD6EXAMPLE \
  --paths "/*"

IAM Advanced Patterns

Policy Management

Create and Manage Policies

# Create IAM policy
aws iam create-policy \
  --policy-name my-policy \
  --policy-document file://policy.json

# Create policy version
aws iam create-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/my-policy \
  --policy-document file://new-policy.json \
  --set-as-default

# List policy versions
aws iam list-policy-versions \
  --policy-arn arn:aws:iam::123456789012:policy/my-policy

IAM Policy Simulation

Validate Policies Before Deployment

# Simulate principal policy
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/myuser \
  --action-names s3:GetObject s3:PutObject s3:DeleteObject \
  --resource-arns "arn:aws:s3:::my-bucket/*"

# Simulate principal policy with context
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:user/myuser \
  --action-names dynamodb:GetItem \
  --resource-arns "arn:aws:dynamodb:us-east-1:123456789012:table/my-table" \
  --context-entries '[{"ContextKeyName":"dynamodb:Select","ContextKeyValues":["ALL_ATTRIBUTES"],"ContextKeyType":"string"}]'

Role Management

Create and Manage Roles

# Create role with trust policy
aws iam create-role \
  --role-name my-role \
  --assume-role-policy-document file://trust-policy.json

# Attach managed policy
aws iam attach-role-policy \
  --role-name my-role \
  --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

# Attach inline policy
aws iam put-role-policy \
  --role-name my-role \
  --policy-name my-inline-policy \
  --policy-document file://inline-policy.json

Access Keys Management

Key Rotation

# List access keys
aws iam list-access-keys --user-name myuser

# Create access key
aws iam create-access-key --user-name myuser

# Rotate access keys
aws iam update-access-key \
  --access-key-id AKIAIOSFODNN7EXAMPLE \
  --status Inactive \
  --user-name myuser

# Delete old access key
aws iam delete-access-key \
  --access-key-id AKIAIOSFODNN7EXAMPLE \
  --user-name myuser

Password Policy

Configure Password Policy

# Get account password policy
aws iam get-account-password-policy

# Update password policy
aws iam update-account-password-policy \
  --minimum-length 12 \
  --require-symbols \
  --require-numbers \
  --require-uppercase-letters \
  --require-lowercase-letters \
  --allow-users-to-change-password \
  --max-password-age 90 \
  --password-reuse-prevention 5

MFA Management

Enable MFA

# List MFA devices
aws iam list-mfa-devices --user-name myuser

# Enable MFA device
aws iam enable-mfa-device \
  --user-name myuser \
  --serial-number arn:aws:iam::123456789012:mfa/myuser \
  --authentication-code1 123456 \
  --authentication-code2 789012

Secrets Manager

Secret Management

# Create secret
aws secretsmanager create-secret \
  --name my-secret \
  --secret-string '{"username":"admin","password":"secret123"}'

# Get secret value
aws secretsmanager get-secret-value \
  --secret-id my-secret \
  --query SecretString \
  --output text

# Update secret
aws secretsmanager put-secret-value \
  --secret-id my-secret \
  --secret-string '{"username":"admin","password":"newpassword"}'

# Rotate secret
aws secretsmanager rotate-secret \
  --secret-id my-secret

# Delete secret (with recovery)
aws secretsmanager delete-secret \
  --secret-id my-secret \
  --recovery-window-in-days 7

Cross-Account Secret Access

# Grant cross-account access to secret
aws secretsmanager put-resource-policy \
  --secret-id my-secret \
  --resource-policy '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::987654321098:root"},
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "*"
    }]
  }'

Security Best Practices

1. VPC: Use private subnets for sensitive workloads, enable flow logs 2. Security Groups: Use least-privilege, prefer security groups over CIDR ranges 3. IAM: Use IAM roles instead of access keys, implement MFA 4. Secrets Manager: Enable automatic rotation, use cross-account access 5. Route53: Use health checks for automated failover 6. CloudFront: Enable WAF, use origin access identity for S3 7. Monitoring: Enable CloudTrail for all API calls, use GuardDuty