We use cookies for site analytics. Accept to help us understand how the site is used. See our Privacy Policy for details.
Profiles and credential resolution, the --query vs --filters distinction that trips people up, and the EC2 / S3 / IAM / VPC / Lambda / CloudWatch commands you actually reach for under time pressure.
Two places this gets tested. In cloud and DevOps interviews the CLI is the fastest way to show you have actually operated an account rather than clicked through a console - an interviewer asking "how would you find every unencrypted volume?" wants a command, not a screenshot tour. In the AWS certification exams the CLI shows up as the answer to "which action accomplishes X", so knowing which service namespace owns which verb (s3 vs s3api, ec2 vs elbv2) is worth real marks. The mental model underneath everything: the CLI is a thin, generated wrapper over the AWS APIs, so every command is <service> <api-action-in-kebab-case>, every response is JSON, and anything you can do in the console has an API and therefore a command.
Credentials resolve in a fixed order: command-line flags, then environment variables, then the profile named by AWS_PROFILE, then the [default] profile, then container/instance metadata (the IAM role). When a command hits the wrong account, walk that list from the top.
| Command | What it does | Common flags | Example |
|---|---|---|---|
| aws configure | Interactive setup - writes keys to ~/.aws/credentials and region/output to ~/.aws/config. | --profile <name> (named profile), list (show resolved values + where each came from) | aws configure --profile staging |
| aws configure sso | Wire up IAM Identity Center. The modern default for humans - short-lived credentials, no long-lived keys on disk. | aws sso login --profile <name>, aws sso logout | aws sso login --profile prod-admin |
| aws sts get-caller-identity | Who am I? Returns Account, Arn and UserId. The first command to run before anything destructive. | --query Account --output text | aws sts get-caller-identity --query Account --output text |
| aws configure list-profiles | Every profile name the CLI can see. | - | aws configure list-profiles |
| aws sts assume-role | Get temporary credentials for another role. Usually better done declaratively with role_arn + source_profile in ~/.aws/config. | --role-arn, --role-session-name, --duration-seconds | aws sts assume-role --role-arn arn:aws:iam::111122223333:role/Audit --role-session-name audit |
They look interchangeable and are not. Getting this right is both an efficiency point and a common interview follow-up.
| Command | What it does | Common flags | Example |
|---|---|---|---|
| aws ec2 describe-instances | List instances. The response is doubly nested (Reservations -> Instances), which is why it is almost always paired with --query. | --instance-ids, --filters Name=tag:Env,Values=prod, --query 'Reservations[].Instances[].InstanceId' | aws ec2 describe-instances --filters Name=instance-state-name,Values=running --query 'Reservations[].Instances[].[InstanceId,Tags[?Key==`Name`]|[0].Value]' --output table |
| aws ec2 run-instances | Launch instances. | --image-id, --instance-type, --key-name, --security-group-ids, --subnet-id, --count, --tag-specifications, --user-data file://boot.sh | aws ec2 run-instances --image-id ami-0abcdef --instance-type t3.micro --subnet-id subnet-123 --count 1 |
| aws ec2 start/stop/terminate-instances | Lifecycle. stop keeps the EBS root volume and the instance id; terminate is permanent. | --instance-ids (required), stop --force, --hibernate | aws ec2 stop-instances --instance-ids i-0abc i-0def |
| aws ec2 describe-security-groups | Security groups and their rules. | --group-ids, --filters Name=vpc-id,Values=vpc-123 | aws ec2 describe-security-groups --filters Name=ip-permission.from-port,Values=22 --query 'SecurityGroups[].GroupId' |
| aws ec2 authorize-security-group-ingress | Add an inbound rule. The revoke- counterpart removes one. | --group-id, --protocol, --port, --cidr, --source-group (reference another SG instead of a CIDR) | aws ec2 authorize-security-group-ingress --group-id sg-123 --protocol tcp --port 443 --cidr 0.0.0.0/0 |
| aws ec2 describe-volumes | EBS volumes. The go-to for encryption audits. | --filters Name=encrypted,Values=false, --volume-ids | aws ec2 describe-volumes --filters Name=encrypted,Values=false --query 'Volumes[].[VolumeId,Size,State]' --output table |
| aws ec2 create-snapshot / create-image | Point-in-time copy of a volume, or a bootable AMI from an instance. | create-snapshot --volume-id --description; create-image --instance-id --name --no-reboot | aws ec2 create-image --instance-id i-0abc --name web-2026-08-14 --no-reboot |
| aws ec2 describe-vpcs / describe-subnets | VPC and subnet inventory. | --filters Name=vpc-id,Values=vpc-123, --query | aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-123 --query 'Subnets[].[SubnetId,CidrBlock,AvailabilityZone]' --output table |
aws s3 is a hand-written, high-level command set (recursive copies, sync, multipart handled for you). aws s3api is the generated one-to-one API mapping. If a flag you need does not exist on aws s3, it lives on s3api.
| Command | What it does | Common flags | Example |
|---|---|---|---|
| aws s3 ls | List buckets, or objects under a prefix. | --recursive, --human-readable, --summarize (total size + object count) | aws s3 ls s3://my-bucket/logs/ --recursive --summarize |
| aws s3 cp / mv | Copy or move, local<->S3 or S3<->S3. Handles multipart automatically. | --recursive, --exclude '*' --include '*.log', --storage-class, --sse, --dryrun | aws s3 cp ./dist s3://my-bucket/site/ --recursive --exclude '*.map' |
| aws s3 sync | One-way sync - copies only what differs by size/mtime. The deploy workhorse. | --delete (remove destination extras), --exact-timestamps, --dryrun, --size-only | aws s3 sync ./build s3://my-bucket --delete --dryrun |
| aws s3 rm | Delete objects. | --recursive, --exclude/--include, --dryrun | aws s3 rm s3://my-bucket/tmp/ --recursive --dryrun |
| aws s3api get-bucket-policy | Read the bucket policy. put-bucket-policy writes one; delete-bucket-policy removes it. | --bucket, --output text --query Policy | aws s3api get-bucket-policy --bucket my-bucket --query Policy --output text |
| aws s3api put-public-access-block | The Block Public Access guardrail. Also available account-wide via aws s3control put-public-access-block. | --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true | aws s3api put-public-access-block --bucket my-bucket --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true |
| aws s3api put-bucket-versioning | Turn on versioning. Once enabled it can be suspended but never removed. | --versioning-configuration Status=Enabled | aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled |
| aws s3 presign | Time-limited signed URL for a single object. | --expires-in <seconds> (default 3600) | aws s3 presign s3://my-bucket/report.pdf --expires-in 900 |
| Command | What it does | Common flags | Example |
|---|---|---|---|
| aws iam list-users / list-roles | Principal inventory. | --path-prefix, --query 'Users[].UserName' | aws iam list-roles --query 'Roles[].RoleName' --output text |
| aws iam create-role | Create a role. The trust policy (who may assume it) is separate from the permissions policy (what it may do) - conflating the two is a classic exam trap. | --role-name, --assume-role-policy-document file://trust.json, --max-session-duration | aws iam create-role --role-name AppRole --assume-role-policy-document file://trust.json |
| aws iam attach-role-policy | Attach a managed policy. put-role-policy embeds an inline one instead. | --role-name, --policy-arn | aws iam attach-role-policy --role-name AppRole --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess |
| aws iam simulate-principal-policy | Answer "can this principal do this action?" without performing it. Underused and a strong interview mention. | --policy-source-arn, --action-names, --resource-arns | aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::111122223333:role/AppRole --action-names s3:GetObject |
| aws iam get-account-authorization-details | Full dump of users, groups, roles and every attached policy document. The one-shot audit command. | --filter Role, --output json > audit.json | aws iam get-account-authorization-details --filter Role > roles.json |
| aws iam generate-credential-report | Build then fetch (get-credential-report) a CSV of every user's key age, MFA status and last use. Standard compliance evidence. | get-credential-report --query Content --output text | base64 -d | aws iam generate-credential-report |
| Command | What it does | Common flags | Example |
|---|---|---|---|
| aws lambda list-functions | Function inventory with runtime and memory. | --query 'Functions[].[FunctionName,Runtime,MemorySize]' --output table | aws lambda list-functions --query 'Functions[].[FunctionName,Runtime]' --output table |
| aws lambda update-function-code | Ship new code to an existing function. | --function-name, --zip-file fileb://f.zip (note fileb, binary), --s3-bucket/--s3-key, --image-uri, --publish | aws lambda update-function-code --function-name api --zip-file fileb://build.zip --publish |
| aws lambda invoke | Invoke and write the response to a file. The output file argument is positional and required. | --payload fileb://event.json, --invocation-type Event (async) | RequestResponse, --log-type Tail | aws lambda invoke --function-name api --payload fileb://event.json out.json |
| aws logs tail | Live-tail a log group. Far and away the fastest way to debug a Lambda. | --follow, --since 1h, --filter-pattern 'ERROR', --format short | aws logs tail /aws/lambda/api --follow --since 15m |
| aws logs filter-log-events | Scriptable historical search across log streams. | --log-group-name, --start-time / --end-time (epoch MILLISECONDS), --filter-pattern | aws logs filter-log-events --log-group-name /aws/lambda/api --filter-pattern ERROR --start-time 1755100000000 |
| aws cloudwatch get-metric-statistics | Pull a metric series. | --namespace, --metric-name, --dimensions, --start-time/--end-time (ISO8601), --period, --statistics | aws cloudwatch get-metric-statistics --namespace AWS/Lambda --metric-name Errors --dimensions Name=FunctionName,Value=api --start-time 2026-08-13T00:00:00Z --end-time 2026-08-14T00:00:00Z --period 3600 --statistics Sum |
| aws cloudwatch put-metric-alarm | Create or overwrite an alarm. | --alarm-name, --metric-name, --threshold, --comparison-operator, --evaluation-periods, --alarm-actions <sns-arn>, --treat-missing-data | aws cloudwatch put-metric-alarm --alarm-name lambda-errors --namespace AWS/Lambda --metric-name Errors --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --alarm-actions arn:aws:sns:us-east-1:111122223333:ops |
Time and space complexity for the data structures, sorting algorithms, and search routines that show up in coding interviews. Skim the row, remember the row, defend the row in an interview.
The recurring shapes - sliding window, two pointers, fast/slow, BFS/DFS, backtracking, DP, divide & conquer, binary search variants, union-find, topological sort. Each entry: when to reach for it, the template, complexity, and which classic problems use it.
The recurring forks in system design interviews. CAP, PACELC, sync vs async, push vs pull, SQL vs NoSQL, sharding shapes, consistency models, cache strategies, idempotency, and rate limiting. For each, the options and when to choose each.
Filesystem layout, the commands you actually use (find / grep / awk / sed / xargs), processes and signals, networking, permissions, basic shell scripting, and a vi survival kit.
Query clause order, every JOIN type and when to use it, aggregates vs window functions, what indexes actually buy you, transaction isolation levels, and the NULL / WHERE-vs-HAVING / EXISTS-vs-IN gotchas interviewers fish for.
The everyday commands, every undo scenario mapped to its fix, rebase vs merge with a side to pick, interactive rebase, bisect, the reflog safety net, stash, and the flags worth aliasing.
The docker and kubectl commands you reach for daily, Dockerfile best practices, how layer caching actually works, the core k8s objects in one screen, requests vs limits, liveness vs readiness, and a step-by-step CrashLoopBackOff debug flow.
Method semantics and idempotency, the ~15 status codes that matter, resource naming rules, offset vs cursor pagination, versioning and auth tradeoffs, error body conventions, rate-limit headers, and the smells reviewers flag.
The STAR structure with timing, what interviewers actually grade, eight question archetypes and how to frame each, the anti-patterns that sink answers (rambling, "we" instead of "I", no metrics), and a 30-second answer skeleton.
TCP vs UDP, the TLS and TCP handshakes, HTTP versions, status codes, DNS resolution, the OSI and TCP/IP layer models, and the ports you are expected to know in an interview.
Anchors, character classes, quantifiers, groups, alternation, lookarounds, backreferences, and flags - plus practical patterns and the gotchas that trip people up in interviews.
The USE method, a first-five-minutes triage runbook, and the CPU, memory, disk, network, and tracing commands you reach for when a Linux box is misbehaving.
A fast reference for concurrency primitives, synchronization tradeoffs, the memory model, and the classic bugs that show up in systems interviews and real code.
A reference for the theorems, consistency models, replication and partitioning strategies, delivery guarantees, and resilience patterns that come up in system design interviews.
Topics, partitions, and consumer groups, the three delivery semantics and how Kafka actually achieves each, ordering guarantees, rebalancing, retention vs compaction, and a straight Kafka vs SQS vs RabbitMQ vs Kinesis comparison.
Schema, types, and resolvers, the three operation kinds, the N+1 problem and DataLoader, cursor vs offset pagination, error handling that actually works, security (depth limiting, query cost), and an honest answer to 'when does REST beat GraphQL'.
State and why it must be remote and locked, the init/plan/apply lifecycle, modules and variables, count vs for_each, workspaces, import and drift, a command table, and the gotchas (prevent_destroy, secrets in state) that mark real production experience.
How LLMs work in one paragraph, the knobs (context window, temperature, top-p), system vs user prompts, few-shot and chain-of-thought, RAG and embeddings, the fine-tune-vs-prompt decision, tool calling, eval basics, and the interview questions teams actually ask now.
How B-tree indexes actually work, composite index column order, covering indexes, reading EXPLAIN ANALYZE, why the planner ignores your index, join algorithms, N+1, keyset pagination, and the 'why is this query slow' scenarios interviews are built on.
Login and subscription juggling, the resource-group model everything hangs off, JMESPath --query, and the VM / storage / AKS / Key Vault / App Service commands worth knowing cold.
Configurations and the project/ADC model, gcloud vs gsutil vs bq, and the Compute Engine / GKE / Cloud Run / IAM / BigQuery commands that carry the ACE and Professional exams.
Chart anatomy, the values precedence order that explains every "why did my override not apply", install vs upgrade --install, template vs dry-run vs diff, and rollback.
The gh commands that remove the browser round-trip: PR create/review/merge, issues, run watching and log digging on Actions, releases, and gh api for anything without a command.
The same operation in all three CLIs, side by side - compute, storage, networking, IAM, Kubernetes, serverless and logging - plus the service-name mapping and the model differences the equivalences hide.
Reading is the floor. The signal in interviews comes from working problems out loud and defending your tradeoffs. Spin up an AI mock interview or run a coding challenge to put these to work.