AWS No KYC Account AWS EC2 CLI tool usage guide

AWS Account / 2026-05-15 16:32:28

{ "description": "This guide walks you through using the AWS EC2 Command Line Interface (CLI) tool with practical, copy-and-paste-friendly commands. You’ll learn how to install and configure AWS CLI credentials, verify access, set a default region, and use common EC2 operations like listing instances, starting and stopping machines, checking security groups, and viewing logs. Along the way, it highlights typical mistakes (like wrong regions, missing permissions, and forgetting instance IDs) and includes friendly troubleshooting tips so you can move faster with fewer “why is this failing?” moments.", "content": "

Introduction: Welcome to the Command Line Rollercoaster

If you’ve ever said, “I’ll just spin up a quick instance,” and then spent the next thirty minutes clicking through menus like you’re assembling IKEA furniture, congratulations: you’re ready for the AWS EC2 CLI tool. The AWS EC2 Command Line Interface (CLI) lets you manage your Amazon EC2 resources using typed commands—fast, repeatable, scriptable, and surprisingly satisfying.

This guide is for humans who want clarity. We’ll cover what the EC2 CLI is, how to install and configure it, how to use it for everyday tasks, and how to troubleshoot the most common problems. We’ll also discuss how to avoid the classic “works in one region, fails in another” trap—because the CLI won’t read your mind, and AWS definitely won’t apologize for it.

AWS No KYC Account We’ll focus on practical usage: listing instances, starting/stopping, retrieving instance details, inspecting security groups, and using helpful parameters so your commands don’t turn into cryptic spellbooks.

\n\n

What Is the EC2 CLI Tool?

When people say “EC2 CLI tool,” they usually mean the AWS Command Line Interface (AWS CLI) running commands for Amazon EC2. AWS CLI is the Swiss Army knife. The EC2 “portion” is simply the set of commands under the ec2 service.

For example, you’ll often use commands like:

aws ec2 describe-instances to list instances and their properties
aws ec2 start-instances to power on instances
aws ec2 stop-instances to power them down
aws ec2 create-security-group and friends to manage networking permissions

Because it’s AWS CLI, you also get consistent authentication, consistent output options, and the ability to run commands in scripts and automation pipelines. In other words: less clicking, more controlling.

\n\n

Prerequisites: Your Identity, Your Permissions, and Your Keyboard

Before you run anything, you need a few ingredients:

An AWS account (obviously—unless you’re planning to summon instances from another dimension)
A way to authenticate AWS CLI (access key/secret key, SSO, or other supported methods)
Permissions for EC2 actions you intend to use (like describing instances, starting/stopping, etc.)
Your AWS CLI installed on your machine

\n\n

Tip: Least Privilege Is Great, Until You Need One More Permission

Security best practice is to grant only the permissions you need. That’s excellent. But when something fails, it might be because you lack one small permission like ec2:DescribeInstances. When you see authorization errors, don’t panic—check your IAM policies or ask whoever manages them.

\n\n

Step 1: Install AWS CLI

AWS CLI is commonly preinstalled on some developer environments, but not always. Here are typical installation approaches:

\n\n

On macOS (Homebrew)

If you use Homebrew, you can install AWS CLI using:

AWS No KYC Account brew install awscli

After installing, verify:

aws --version

\n\n

On Linux (Common approaches)

Depending on the distro, you might use a package manager, a bundled installer, or a virtual environment. Many teams use:

pip install --upgrade awscli

Or they use the official installer approach. If your environment is locked down, ask your administrator what’s allowed. (Yes, sometimes your keyboard is permitted; the internet might not be.)

\n\n

On Windows

Windows users can install via MSI, package managers, or PowerShell-based installers. Once installed, verify:

aws --version

\n\n

Step 2: Configure AWS CLI Credentials

Configuration is the heart of CLI success. Without credentials, AWS CLI is like a bicycle without wheels: technically present, emotionally unhelpful.

\n\n

Quick Start Configuration

Run:

aws configure

You’ll be prompted for:

AWS Access Key ID
AWS Secret Access Key
Default region name (for example, us-east-1)
Default output format (like json)

You can choose json for readability during learning. Later, many people prefer table for humans and json for scripts.

\n\n

Where Configuration Lives

AWS CLI typically stores config and credentials here:

~/.aws/credentials (access keys and secrets)
~/.aws/config (region, default settings, profiles)

If you have multiple accounts or roles, you’ll likely use profiles, which we’ll cover next.

\n\n

Profiles: Because One Account Is Never Enough

If you work with multiple AWS accounts (dev, staging, prod) you should use profiles. Create or select a profile:

aws configure --profile myprofile

Then run commands like:

aws ec2 describe-instances --profile myprofile

You can also set an environment variable:

AWS_PROFILE=myprofile

Then you can omit --profile on each command. Handy, but don’t forget you changed it—future-you may be confused and future-you deserves kindness.

\n\n

Step 3: Verify CLI Works (Before You Start Spinning Up Resources)

Let’s confirm everything is set. A simple command is:

aws ec2 describe-regions

This lists regions you can access. If this works, you’ve cleared the “authentication + basic access” hurdle.

You can also check your identity:

AWS No KYC Account aws sts get-caller-identity

AWS No KYC Account This tells you which AWS user or role you are using.

\n\n

Step 4: Use Helpful Output Formats (Your Sanity Matters)

By default, AWS CLI outputs JSON. That’s powerful, but not always friendly while learning. You can choose output formats using --output or in your config.

Common formats:

json (full detail, machine-friendly)
text (less structure)
table (great for quick viewing)

Example:

aws ec2 describe-instances --output table

Be aware: some EC2 commands can output large tables. If you have lots of instances, you might prefer to filter results using query options (more on that soon).

\n\n

Core EC2 CLI Workflows (What You’ll Do Every Day)

Now for the fun part: real tasks you’ll probably repeat. We’ll build from discovery to action, and then to inspection and cleanup.

\n\n

Listing Instances: “What’s Running, and Why Is It Still Running?”

To list instances, use:

aws ec2 describe-instances

This returns a lot of data. For readability, you’ll want to filter or extract specific fields.

\n\n

List Instance IDs Only

Use a JMESPath query with --query. For example, to extract instance IDs:

AWS No KYC Account aws ec2 describe-instances --query "Reservations[].Instances[].InstanceId" --output text

You’ll get output like:

i-0123456789abcdef0 i-0fedcba9876543210

\n\n

List Instances with Names and States

Most teams tag instances with a Name. You can query for state and name like this:

aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId, State.Name, Tags[?Key=='Name']|[0].Value]" --output table

If that query looks spicy, don’t worry. The main idea is: filter the results to the fields you care about.

If you don’t have a Name tag, the “Name” column might appear blank. This is normal. AWS doesn’t require names, only existence. Though in practice, lack of names leads to confusion, which leads to regret, which leads to extra coffee.

\n\n

Filter by Instance State

Want only running instances? You can filter using --filters:

aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" --query "Reservations[].Instances[].InstanceId" --output text

\n\n

Filter by Tag (Example: Environment=dev)

If your instances are tagged:

aws ec2 describe-instances --filters "Name=tag:Environment,Values=dev" --query "Reservations[].Instances[].InstanceId" --output text

This is useful for separating dev from prod without relying on your memory (a notoriously unreliable system).

\n\n

Starting and Stopping Instances: The “Do I Really Want to Pay for This?” Buttons

Starting and stopping are among the most common actions. Always identify the instance IDs first.

\n\n

Start Instances

To start one or more instances:

aws ec2 start-instances --instance-ids i-0123456789abcdef0

If you have multiple:

aws ec2 start-instances --instance-ids i-0123456789abcdef0 i-0fedcba9876543210

\n\n

Stop Instances

To stop instances:

aws ec2 stop-instances --instance-ids i-0123456789abcdef0

Note: stopping an instance keeps the EBS volumes (if using them). Terminating would delete many associated resources depending on configuration.

\n\n

Reboot Instances (Because Sometimes “Turn It Off and On Again” Works)

To reboot:

aws ec2 reboot-instances --instance-ids i-0123456789abcdef0

\n\n

Wait Until State Changes: Avoid Race Conditions

Sometimes scripts need to wait for state transitions. AWS CLI provides waiters, such as:

aws ec2 wait instance-running --instance-ids i-0123456789abcdef0

Or:

aws ec2 wait instance-stopped --instance-ids i-0123456789abcdef0

This helps avoid commands that fail because the instance is still transitioning.

\n\n

Describing Instance Details: The Detective Work

When something isn’t behaving, instance details are your evidence. Use:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0

\n\n

Show Key Fields (State, Type, AMI, Launch Time)

Example query:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].[InstanceId, State.Name, InstanceType, ImageId, LaunchTime]" --output table

That gives a compact overview you can scan quickly.

\n\n

Get Private and Public IPs

To extract IP addresses:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].[PrivateIpAddress, PublicIpAddress]" --output table

If PublicIpAddress is blank, the instance might not have a public IP, or it might be in a configuration where no public address is assigned. This is often expected, especially in private subnets.

\n\n

View Subnet and VPC Information

Useful when troubleshooting routing and connectivity:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].[SubnetId, VpcId]" --output table

\n\n

Security Groups: Where Networking Goes to Get Messy

Security groups control inbound/outbound traffic rules. Let’s inspect them.

\n\n

Find Security Groups Attached to an Instance

Example:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].SecurityGroups[].GroupId" --output text

Or include names too:

AWS No KYC Account aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].SecurityGroups[].[GroupId, GroupName]" --output table

\n\n

Describe a Security Group

Once you have a GroupId, use:

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

\n\n

List Inbound Rules Only

Example query:

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0 --query "SecurityGroups[].IpPermissions" --output json

This outputs raw permission details. For scripts you can parse the JSON. For humans, you might want a better filter, but the exact query varies based on your needs.

\n\n

Common Beginner Mistake: “I Updated the Security Group, But It Still Doesn’t Work”

That can happen if you updated the wrong security group, attached it to the wrong instance, or forgot about additional layers like NACLs, route tables, or a firewall on the instance itself. Security groups are only one part of the networking puzzle. They are helpful, but they are not magic.

\n\n

Tags: Your Instance’s Personality (and Your Best Friend)

Tags are metadata. They help you find, organize, and manage resources. Without them, you’ll eventually start naming instances like “server-1,” “server-2,” and “server-2-final-final.”

\n\n

List Tags on Instances

Example:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].Tags[].[Key,Value]" --output table

\n\n

Filter Instances by a Tag

Example environment filter:

aws ec2 describe-instances --filters "Name=tag:Environment,Values=production" --query "Reservations[].Instances[].InstanceId" --output text

\n\n

Reminder: Tags Are Case-Sensitive

If you tag Environment=Dev but filter for Environment=dev, you may get zero results. AWS won’t send you a sympathy email. It will simply not find anything. This is one of the most common “my command returns nothing” problems.

\n\n

Working with AMIs: What Image Are You Actually Running?

AMI IDs show up in instance details. If you need to see which AMI an instance is using:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].ImageId" --output text

\n\n

Describe the AMI

Once you have the AMI ID (like ami-0abc1234def567890), describe it:

aws ec2 describe-images --image-ids ami-0abc1234def567890 --query "Images[].[ImageId, Name, CreationDate]" --output table

This helps you understand whether the instance is on the latest image or on something… inherited from the past.

\n\n

Listing Volumes: Storage, Where Dreams Go (Mostly)

EBS volumes attach to instances. To list volumes attached to your instances, you can describe instances and look at block device mappings.

\n\n

Show Attached Volume IDs

Example:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId" --output text

\n\n

Describe Volume Details

For a given volume ID:

aws ec2 describe-volumes --volume-ids vol-0123456789abcdef0 --query "Volumes[].[VolumeId, VolumeType, Size, State]" --output table

\n\n

Working with Key Pairs: Access Credentials, But Not the Password Kind

Key pairs are used for SSH access (for Linux instances) and sometimes for other uses. Listing key pairs:

aws ec2 describe-key-pairs

If you’re missing access, you might need to verify which key pair an instance is associated with. Instance-level details can contain the key name:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].KeyName" --output text

If that key name is blank, you might have launched the instance without a key pair (or the instance was managed differently).

\n\n

AWS No KYC Account Using Regions Correctly: The Most Common CLI Problem (Probably)

AWS CLI runs in a region. If you forget to specify the correct region, your commands will return empty results or errors. It’s like looking for your keys in the wrong coat pocket, except the wrong pocket also contains zero keys and no coat.

\n\n

Check Your Default Region

Run:

AWS No KYC Account aws configure get region

Or see it in ~/.aws/config under your profile.

\n\n

Override Region per Command

Add:

--region us-east-1

Example:

aws ec2 describe-instances --region us-west-2 --filters "Name=instance-state-name,Values=running"

\n\n

Switch Profiles and Regions Together

If you use profiles, you might set region per profile. Just ensure you’re using the right combination of profile and region. This prevents the dreaded “I swear it exists!” confusion.

\n\n

Common “Why Is This Failing?” Troubleshooting

AWS No KYC Account Let’s cover some classic problems and how to respond without throwing your laptop into a river.

\n\n

Error: “Unable to locate credentials”

Meaning: AWS CLI cannot find authentication credentials. Fix by:

Running aws configure (or configuring a profile with --profile)
Ensuring environment variables like AWS_ACCESS_KEY_ID aren’t incorrectly set
Using the correct profile via --profile or AWS_PROFILE

\n\n

Error: “You are not authorized to perform this operation”

Meaning: your IAM role/user lacks permission. Ask your AWS admin to grant the needed action, such as:

ec2:DescribeInstances
ec2:StartInstances
ec2:StopInstances
ec2:DescribeSecurityGroups

If you’re operating with assumed roles, confirm the trust policy and the role permissions.

\n\n

Error: “InvalidInstanceID.NotFound”

Meaning: the instance ID doesn’t exist in the selected region (or the ID is wrong). Fix by:

Double-checking instance ID spelling
Verifying region
Listing instances in the region to confirm

\n\n

Command Returns Nothing

Meaning: your filters are too strict (or wrong tags/values). Check:

Case sensitivity for tag values
Correct tag key name (like Environment vs environment)
Instance state filters (stopped vs running)
Region correctness

\n\n

Stop/Start Does Nothing (Or Feels Slow)

Instances take time to transition states. Use waiters:

aws ec2 wait instance-stopped --instance-ids i-0123456789abcdef0

Also verify that the instance is in a state where the action is allowed. You can’t always start an instance that’s already running (AWS will complain politely, but still complain).

\n\n

Power Moves: Querying with JMESPath for Cleaner Results

One of the best parts of AWS CLI is --query. It lets you extract the specific bits you care about without manually sifting through mountains of JSON.

At a high level, --query uses JMESPath expressions. You don’t need to become a wizard, but learning a few patterns will make your CLI life dramatically easier.

\n\n

Common Pattern: Extract a Field from Nested Results

When describing instances, you often see:

Reservations[]
Instances[]
then fields like InstanceId, State.Name, etc.

So you might do something like:

--query "Reservations[].Instances[].InstanceId"

\n\n

Filter by Condition (Example: Only Instances with a Name Tag)

You can use tag queries to locate instances with Name. This is helpful if you rely on naming for humans and automation.

Example idea (conceptually): filter instances whose Tags include key Name and then return those values.

Exact expressions can vary, but the main tool is the same: query, filter, extract.

\n\n

Automating with Shell Scripts (When You’re Ready to Level Up)

After you can run commands manually, the next step is automation. This is where CLI really earns its keep.

\n\n

Example: Stop All Dev Instances

First, list instance IDs:

aws ec2 describe-instances --filters "Name=tag:Environment,Values=dev" --query "Reservations[].Instances[?State.Name=='running'].InstanceId" --output text

Then stop them. You might do this in a script using command substitution, depending on your shell:

INSTANCE_IDS=$(aws ec2 describe-instances --filters "Name=tag:Environment,Values=dev" --query "Reservations[].Instances[?State.Name=='running'].InstanceId" --output text)

aws ec2 stop-instances --instance-ids $INSTANCE_IDS

Be careful when using command substitution and whitespace. If the query returns multiple IDs, make sure your shell treats them correctly. Test with echo first:

echo $INSTANCE_IDS

\n\n

Example: Start Instances and Wait Until Running

You can combine action with waiters:

aws ec2 start-instances --instance-ids i-0123456789abcdef0

aws ec2 wait instance-running --instance-ids i-0123456789abcdef0

Then proceed to dependent steps like health checks or deployment tasks.

\n\n

Safety Tips: Don’t Summon Costs Like a Chaotic Mage

AWS No KYC Account Starting instances can cost money. Stopping saves money. Terminating can save money even faster (but can also delete data), so use caution.

\n\n

Use Dry Runs When Supported

Some AWS API calls support --dry-run. Not all EC2 operations do, but when available, it’s a good way to validate permissions and request correctness without actually changing resources.

\n\n

Prefer Stopping Over Terminating (Usually)

For many workloads, stopping is safer. Terminating deletes the instance and often the root disk unless you took special precautions. If you’re unsure, stop first and confirm access to needed resources.

\n\n

Tag Everything You Can

Tags make it easier to stop the right things later. If you tag instances with Environment, Owner, CostCenter, or Project, your future self will thank your present self. Your future self is not particularly nice to past self unless the past self made good tagging decisions.

\n\n

Frequently Used EC2 CLI Commands (Quick Reference)

AWS No KYC Account Here’s a compact list of commands you’ll likely use repeatedly:

aws ec2 describe-instances
aws ec2 start-instances
aws ec2 stop-instances
aws ec2 reboot-instances
aws ec2 describe-security-groups
aws ec2 describe-volumes
aws ec2 describe-images
aws ec2 describe-key-pairs
AWS No KYC Account aws sts get-caller-identity
aws ec2 describe-regions

\n\n

Example Mini-Playbook: From Zero to “I Know What’s Happening”

Let’s walk through a realistic scenario: you need to restart a service running on an EC2 instance. You suspect the instance might be in a stopped state or the network rules might have changed.

\n\n

1) Identify Running Instances

aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" --query "Reservations[].Instances[].[InstanceId,State.Name,Tags[?Key=='Name']|[0].Value]" --output table

\n\n

2) Pick the Correct Instance by Name Tag

If your table shows something like “web-server-prod,” choose that instance ID.

\n\n

3) Check the Instance State and Networking

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].[InstanceId, State.Name, PrivateIpAddress, PublicIpAddress, VpcId, SubnetId]" --output table

\n\n

4) Inspect Security Groups

Find security groups attached to the instance:

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].SecurityGroups[].[GroupId,GroupName]" --output table

Then describe one of those security groups:

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

\n\n

5) Reboot the Instance (or Start/Stop if Needed)

If it’s running and you just need a restart:

aws ec2 reboot-instances --instance-ids i-0123456789abcdef0

If it’s stopped, start it and wait:

aws ec2 start-instances --instance-ids i-0123456789abcdef0

aws ec2 wait instance-running --instance-ids i-0123456789abcdef0

\n\n

Extending Beyond Basics: What to Explore Next

Once you’re comfortable, you can expand into more advanced topics:

Creating and terminating instances
Managing launch templates and autoscaling groups
Handling Elastic IPs
Working with load balancers
Managing IAM roles for EC2 (instance profiles)
Using scripts for lifecycle management

The core lesson stays the same: list resources first, identify the correct IDs, then take action with confidence.

\n\n

Closing Thoughts: You’re Now Dangerous (In a Good Way)

Learning the AWS EC2 CLI tool is like learning to drive a stick shift. At first you stall a lot. Then you get smoother. Then you realize you’re actually faster than your friends who only know automatics, and you start making hill starts without fear.

Remember these golden rules:

Always verify region and profile
List instances and security groups before taking action
Use --query and --output to keep results readable
Use waiters to avoid timing issues
Expect permissions errors and treat them as feedback, not betrayal

If you apply those rules, you’ll spend less time clicking and more time shipping. And if you’re anything like the rest of us, that means more time for the important tasks, like celebrating small wins and refusing to pay for idle servers that have been “running” since last Tuesday.

\n\n

Appendix: Command Snippet Collection (Copy-Friendly)

Check AWS CLI identity

aws sts get-caller-identity

\n\n

List regions

aws ec2 describe-regions --output table

\n\n

List running instance IDs

aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" --query "Reservations[].Instances[].InstanceId" --output text

\n\n

List instances with IDs and states

aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId,State.Name]" --output table

\n\n

Start instance

aws ec2 start-instances --instance-ids i-0123456789abcdef0

\n\n

AWS No KYC Account Stop instance

aws ec2 stop-instances --instance-ids i-0123456789abcdef0

\n\n

Wait for running

aws ec2 wait instance-running --instance-ids i-0123456789abcdef0

\n\n

Wait for stopped

aws ec2 wait instance-stopped --instance-ids i-0123456789abcdef0

\n\n

Get IP addresses

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].[InstanceId,PrivateIpAddress,PublicIpAddress]" --output table

\n\n

Get security groups for an instance

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].SecurityGroups[].[GroupId,GroupName]" --output table

\n\n

Describe a security group

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

\n\n

Describe volumes attached to an instance

aws ec2 describe-instances --instance-ids i-0123456789abcdef0 --query "Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId" --output text

\n\n

Describe a volume

aws ec2 describe-volumes --volume-ids vol-0123456789abcdef0 --query "Volumes[].[VolumeId,VolumeType,Size,State]" --output table

\n\n

Filter instances by Environment tag

aws ec2 describe-instances --filters "Name=tag:Environment,Values=dev" --query "Reservations[].Instances[].InstanceId" --output text

\n" }